rorleggertroms.com Open in urlscan Pro
81.177.135.102 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Submission: On September 12 via api (September 12th 2023, 7:21:39 am UTC) from US — Scanned from DE

Summary HTTP 214 Redirects Behaviour Indicators

Summary

This website contacted 40 IPs in 8 countries across 33 domains to perform 214 HTTP transactions. The main IP is 81.177.135.102, located in Russian Federation and belongs to RTCOMM-AS, RU. The main domain is rorleggertroms.com.
TLS certificate: Issued by R3 on August 22nd 2023. Valid for: 3 months.

This is the only time rorleggertroms.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
55	81.177.135.102 81.177.135.102	8342 (RTCOMM-AS) (RTCOMM-AS)
48	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
21	2606:4700:e2:... 2606:4700:e2::ac40:8817	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
5 16	2a02:6b8::1:119 2a02:6b8::1:119	208722 (GLOBAL_DC) (GLOBAL_DC)
1	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	23.35.236.201 23.35.236.201	16625 (AKAMAI-AS) (AKAMAI-AS)
12	2a05:d014:776... 2a05:d014:776:a63d:6339:2a28:fc90:eea	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6810:5914	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::6816:3556	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	18.66.97.88 18.66.97.88	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:225... 2600:9000:2250:4e00:a:e047:753:6381	16509 (AMAZON-02) (AMAZON-02)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a02:2638:d::2 2a02:2638:d::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
2	185.64.190.84 185.64.190.84	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	34.120.107.143 34.120.107.143	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	63.35.30.113 63.35.30.113	16509 (AMAZON-02) (AMAZON-02)
1 2	2a02:2638:3::c 2a02:2638:3::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	162.19.138.116 162.19.138.116	16276 (OVH) (OVH)
1	178.250.7.13 178.250.7.13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	51.89.9.254 51.89.9.254	16276 (OVH) (OVH)
1	145.40.97.67 145.40.97.67	54825 (PACKET) (PACKET)
1	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	185.64.189.226 185.64.189.226	62713 (AS-PUBMATIC) (AS-PUBMATIC)
5	2a00:1450:400... 2a00:1450:4001:829::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1 2	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
1 7	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1 1	35.204.74.118 35.204.74.118	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
2 2	185.64.190.78 185.64.190.78	62713 (AS-PUBMATIC) (AS-PUBMATIC)
2 2	216.52.2.6 216.52.2.6	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
1 1	20.127.253.7 20.127.253.7	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	172.64.146.152 172.64.146.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 4	104.18.41.104 104.18.41.104	13335 (CLOUDFLAR...) (CLOUDFLARENET)
214	40

55 81.177.135.102 (Russian Federation)

ASN8342 (RTCOMM-AS, RU)
PTR: srv146-h-st.jino.ru

rorleggertroms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

48 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2606:4700:e2::ac40:8817 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
g.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bshr.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a02:6b8::1:119 (Moscow, Russian Federation) 5 redirects

ASN208722 (GLOBAL_DC, FI)

mc.yandex.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
mc.yandex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.35.236.201 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-236-201.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a05:d014:776:a63d:6339:2a28:fc90:eea (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:5914 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:3556 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.88 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-88.fra56.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:4e00:a:e047:753:6381 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:d::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.84 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

ow.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.107.143 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 143.107.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.35.30.113 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-30-113.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.19.138.116 (Frankfurt am Main, Germany)

ASN16276 (OVH, FR)
PTR: ns31533567.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.7.13 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.9.254 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip254.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 145.40.97.67 (Amsterdam, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.226 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

t.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:829::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.186.34 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.204.74.118 (Groningen, Netherlands) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 118.74.204.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.78 (United Kingdom) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.52.2.6 (United States) 2 redirects

ASN32475 (SINGLEHOP-LLC, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 20.127.253.7 (Tappahannock, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

sync.inmobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.146.152 (United States)

ASN13335 (CLOUDFLARENET, US)

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.41.104 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
57	doubleclick.net 1 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 215 googleads.g.doubleclick.net — Cisco Umbrella Rank: 53 cm.g.doubleclick.net — Cisco Umbrella Rank: 259	231 KB
55	rorleggertroms.com rorleggertroms.com	529 KB
21	ezodn.com go.ezodn.com — Cisco Umbrella Rank: 9266 ezodn.com — Cisco Umbrella Rank: 8548 g.ezodn.com — Cisco Umbrella Rank: 12098 bshr.ezodn.com — Cisco Umbrella Rank: 10273	320 KB
13	yandex.com 3 redirects mc.yandex.com — Cisco Umbrella Rank: 8136	4 KB
12	ezoic.net g.ezoic.net — Cisco Umbrella Rank: 14848	921 B
9	googlesyndication.com 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 160 pagead2.googlesyndication.com — Cisco Umbrella Rank: 115	50 KB
7	connatix.com 1 redirects capi.connatix.com — Cisco Umbrella Rank: 1819 cd.connatix.com — Cisco Umbrella Rank: 3927 cds.connatix.com — Cisco Umbrella Rank: 4174 vid.connatix.com Failed lit.connatix.com Failed	392 KB
6	pubmatic.com 2 redirects ads.pubmatic.com — Cisco Umbrella Rank: 572 ow.pubmatic.com — Cisco Umbrella Rank: 1957 t.pubmatic.com — Cisco Umbrella Rank: 2867 image6.pubmatic.com — Cisco Umbrella Rank: 869	163 KB
5	gstatic.com fonts.gstatic.com www.gstatic.com	48 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 58 imasdk.googleapis.com — Cisco Umbrella Rank: 521	127 KB
3	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 455 mug.criteo.com — Cisco Umbrella Rank: 2500	7 KB
3	openx.net 1 redirects oajs.openx.net — Cisco Umbrella Rank: 1391 google-bidout-d.openx.net — Cisco Umbrella Rank: 1399	708 B
3	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 828 id5-sync.com — Cisco Umbrella Rank: 432	32 KB
3	yandex.ru 2 redirects mc.yandex.ru — Cisco Umbrella Rank: 3674	70 KB
2	lijit.com 2 redirects ap.lijit.com — Cisco Umbrella Rank: 747	1 KB
2	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 991 r.turn.com — Cisco Umbrella Rank: 4368	869 B
2	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	151 B
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 958 bcp.crwdcntrl.net — Cisco Umbrella Rank: 940	12 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 351	3 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	132 KB
1	inmobi.com 1 redirects sync.inmobi.com — Cisco Umbrella Rank: 1598	711 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 7482	555 B
1	ctnsnet.com 1 redirects gcm.ctnsnet.com — Cisco Umbrella Rank: 41280	610 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 935	714 B
1	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 226	57 KB
1	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 1027
1	onetag-sys.com onetag-sys.com — Cisco Umbrella Rank: 799
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 653 csm.nl3.eu.criteo.net Failed	14 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 1537	8 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 1891	3 KB
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 1492	1 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 1977	256 B
0	33across.com Failed lexicon.33across.com Failed
214	33

	Domain	Requested by
55	rorleggertroms.com	rorleggertroms.com
48	securepubads.g.doubleclick.net	rorleggertroms.com securepubads.g.doubleclick.net
17	go.ezodn.com	rorleggertroms.com go.ezodn.com
13	mc.yandex.com	3 redirects rorleggertroms.com mc.yandex.ru blank
12	g.ezoic.net	go.ezodn.com
7	cm.g.doubleclick.net	1 redirects 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com rorleggertroms.com
5	tpc.googlesyndication.com	rorleggertroms.com 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
3	cds.connatix.com	rorleggertroms.com cd.connatix.com
3	capi.connatix.com	rorleggertroms.com cd.connatix.com
3	www.gstatic.com	rorleggertroms.com 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
3	mc.yandex.ru	2 redirects rorleggertroms.com
3	fonts.googleapis.com	rorleggertroms.com 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
2	ap.lijit.com	2 redirects
2	image6.pubmatic.com	2 redirects
2	www.google.com	1 redirects rorleggertroms.com
2	pagead2.googlesyndication.com	rorleggertroms.com
2	googleads.g.doubleclick.net	rorleggertroms.com 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
2	id5-sync.com	cdn.id5-sync.com rorleggertroms.com
2	gum.criteo.com	1 redirects static.criteo.net
2	oajs.openx.net	1 redirects rorleggertroms.com
2	ow.pubmatic.com	ads.pubmatic.com
2	28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	cdn.jsdelivr.net	securepubads.g.doubleclick.net ads.pubmatic.com
2	bshr.ezodn.com	go.ezodn.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.googletagmanager.com	rorleggertroms.com
1	cd.connatix.com	1 redirects
1	sync.inmobi.com	1 redirects
1	ads.travelaudience.com	1 redirects
1	gcm.ctnsnet.com	1 redirects
1	um.simpli.fi	1 redirects
1	r.turn.com	rorleggertroms.com
1	ad.turn.com	1 redirects
1	www.googletagservices.com	rorleggertroms.com
1	t.pubmatic.com	ads.pubmatic.com
1	google-bidout-d.openx.net	oa.openxcdn.net
1	prebid.a-mo.net	ads.pubmatic.com
1	onetag-sys.com	ads.pubmatic.com
1	mug.criteo.com	rorleggertroms.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	static.criteo.net	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	cdn.id5-sync.com	securepubads.g.doubleclick.net
1	ads.pubmatic.com	rorleggertroms.com
1	imasdk.googleapis.com	rorleggertroms.com cd.connatix.com
1	region1.google-analytics.com	www.googletagmanager.com
1	g.ezodn.com	rorleggertroms.com
1	ezodn.com	rorleggertroms.com
0	csm.nl3.eu.criteo.net Failed	gum.criteo.com
0	lit.connatix.com Failed	cd.connatix.com
0	vid.connatix.com Failed	cd.connatix.com
0	lexicon.33across.com Failed	ads.pubmatic.com
214	55

This site contains no links.

Subject Issuer	Validity	Valid
rorleggertroms.com R3	`2023-08-22` - `2023-11-20`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
ezodn.com E1	`2023-08-30` - `2023-11-28`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
mc.yandex.ru GlobalSign ECC OV SSL CA 2018	`2023-08-14` - `2024-01-24`	5 months	crt.sh
*.pubmatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-25` - `2024-01-24`	a year	crt.sh
ezoic.net R3	`2023-07-19` - `2023-10-17`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
invstatic101.creativecdn.com GTS CA 1D4	`2023-08-26` - `2023-11-24`	3 months	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M01	`2022-11-07` - `2023-12-06`	a year	crt.sh
cdn.prod.uidapi.com R3	`2023-08-10` - `2023-11-08`	3 months	crt.sh
oa.openxcdn.net GTS CA 1D4	`2023-07-27` - `2023-10-25`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-08-05` - `2023-10-31`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-19` - `2023-10-18`	3 months	crt.sh
*.id5-sync.com R3	`2023-09-01` - `2023-11-30`	3 months	crt.sh
*.onetag-sys.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-28` - `2024-01-28`	a year	crt.sh
*.a-mo.net R3	`2023-08-07` - `2023-11-05`	3 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-08-14` - `2023-11-06`	3 months	crt.sh
connatix.com GTS CA 1P5	`2023-09-05` - `2023-12-04`	3 months	crt.sh

This page contains 12 frames:

Primary Page: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Frame ID: 7D830D02A5F69A1D4ECAAC3DC4BD8D84
Requests: 180 HTTP requests in this frame

Frame: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 17A2B3BDFF1986FA79FCE332CB141FBC
Requests: 1 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=rorleggertroms.com&us_privacy=1---
Frame ID: 54A8CD2244AF1C73F475687578CAF360
Requests: 3 HTTP requests in this frame

Frame: https://onetag-sys.com/usync/?cb=1694503269296
Frame ID: 06C088721D939D19C182A9CD1EFFCFED
Requests: 1 HTTP requests in this frame

Frame: https://prebid.a-mo.net/isyn?gdpr_consent=&gdpr=0&us_privacy=&gpp=&gpp_sid=
Frame ID: 52F0A95B6BC56C9C19EC5200101BC417
Requests: 1 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 621EC00FDE594BC00A257350BD3DD830
Requests: 1 HTTP requests in this frame

Frame: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 19B09AFB398A219CEF1602F662C6751F
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: B4E347DF6656184B6C097F8485831D22
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 47CBF8B28F7212B5E90775AE81F68C27
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 220F139093A9340C044CA3034AC50AAD
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/YBinSErTekvxupjb6vinQNaPBzh8KEiIox6QinbqyX4.js
Frame ID: C40AD6C7D7B36ADB38AB67E39FF6014D
Requests: 1 HTTP requests in this frame

Frame: https://cds.connatix.com/p/333934/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882&tier=1
Frame ID: D0EDE169E5D29EE2CEC8D696DF17DBBF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Yandex.Metrika (Analytics) Expand

Overall confidence: 100%
Detected patterns

mc\.yandex\.ru/metrika/(?:tag|watch)\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

214
Requests

90 %
HTTPS

49 %
IPv6

33
Domains

55
Subdomains

40
IPs

8
Countries

2200 kB
Transfer

7006 kB
Size

48
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 110

https://oajs.openx.net/esp?url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rid=esp&cc=1

Request Chain 111

https://mc.yandex.com/sync_cookie_image_check HTTP 302
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10124.wvhYnLpiAQ8vSqVvnEp8Oq3VV72yRglfPeMJWkUYS-Tdkpm98finRCkA2fvfyE_t.xC019RAi9a6iqcldZrlzgkueGqk%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide?token=10124.UYbkI5_1PlVf11fI6Z6tVMXkLuJObj5iKJlT7juKRMDFrg3PxpPMMTi9cDNF3T6Z3gBoDOk-iToZ0IJuvH9QyrmVH7LQR_oa6mzlLYBoYaU%2C.CwZqG79KErdDMoit8Ljp3A_Nzmo%2C

Request Chain 116

https://gum.criteo.com/sid/json?origin=publishertagids&domain=rorleggertroms.com&sn=ChromeSyncframe&so=0&topUrl=rorleggertroms.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=4WQzu3xTNzllZnc4OElqdklyb21wQ3hRQXZDaUpNUlJKNmpWVDJwK3VKcUtqUGh2dUpWalNNUUpvYmVLemllLytWVGwxWFBMUTdwRTZqRVZab2ZuUmtXTnZMbTNpZnl2cWpWT1NjaEYwbEE3aWd1UnBEMzYxTGhiNTZMTUV5ZForL1JoR0txcTRSVit4RWxoZnd6S0JKSzFPSDBNK1R1UGp4WlRMaWttMit5MFp6bUZJQ3lxTVVKdlRwQzNEWndOY0lCRmJJcGFmK0ZrdUUzZkhHaG5lMHVnV0Z3Uk0yMS91eVA5S0g3bkNrZGp4aG8wQ2h1ZHk3QTBBUndDallvVVpDMzg3RVMwV1llbCs1NUpBd0g5SUlSTUtMMDZaVDVNeHgwTU9ZVVIwcW16U2lFND18&cppv=2

Request Chain 119

https://mc.yandex.com/watch/92577418?wmode=7&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A1936%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A177422209012%3Ahid%3A470218800%3Az%3A120%3Ai%3A20230912092109%3Aet%3A1694503269%3Ac%3A1%3Arn%3A909043950%3Arqn%3A1%3Au%3A1694503269437627901%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A269%2C124%2C1279%2C6%2C%2C0%2C%2C312%2C1%2C%2C%2C%2C2104%3Aco%3A0%3Acpf%3A1%3Ans%3A1694503266858%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694503269%3At%3ABetaler%20du%20husleie%20for%20sent%3F%20Finn%20ut%20konsekvensene!&t=gdpr(14)clc(0-0-0)rqnt(1)aw(1)ti(2) HTTP 302
https://mc.yandex.com/watch/92577418/1?wmode=7&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A1936%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A177422209012%3Ahid%3A470218800%3Az%3A120%3Ai%3A20230912092109%3Aet%3A1694503269%3Ac%3A1%3Arn%3A909043950%3Arqn%3A1%3Au%3A1694503269437627901%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A269%2C124%2C1279%2C6%2C%2C0%2C%2C312%2C1%2C%2C%2C%2C2104%3Aco%3A0%3Acpf%3A1%3Ans%3A1694503266858%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694503269%3At%3ABetaler%20du%20husleie%20for%20sent%3F%20Finn%20ut%20konsekvensene%21&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1

Request Chain 121

https://mc.yandex.com/sync_cookie_image_check_secondary HTTP 302
https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10124.6D4ja9hr-kY5ZclloZbGPEnkvSJyEcApAo4eo8iQXEUaAn8GQoITJsyQiemoT0gQ.FWUsqCtT0zeem4oywVH9rgHLSy0%2C HTTP 302
https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10124.eseApLH7q_FHZPe8lHyABk-MDNx8iLvguz_dHPUDMbLMXfoEcfeZ0LdX9akNcVvGaXukgIN3m1bBFzJedW1Y96vgsf2iUV93mTceyCHIluY%2C.zKDnzgqiNpGtzd1FLugRpT1xTsY%2C

Request Chain 150

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 151

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEE7OhJW-va18aIMdAQAtwzI&google_cver=1&google_push=AXcoOmSSu5bGc68EPbU49jQph2xXFgrXMdSsGvuTZrCgdyMsYeYNq9WJwonI2_TwR7DG6c7OqTDZlsbTpSpUkpmu2SCjnc-4ePxpdg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDMyMTcwNTM0MzEzMDY1NTQyMw==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEE7OhJW-va18aIMdAQAtwzI&google_cver=1

Request Chain 152

https://um.simpli.fi/gp_match?google_gid=CAESECnRTN9_jCXdnHFH36tgjII&google_cver=1&google_push=AXcoOmS3cSVVYf6lof5EiwSyfH7BTR-z3rgZ5dnDnVRx_qb5C-AC-MwaXUULH5LVys1vFnDnEM-V-lejMrZlGT83a7v7sQX-N4L7nA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=911C119B35784528879974C49D838949&google_push=AXcoOmS3cSVVYf6lof5EiwSyfH7BTR-z3rgZ5dnDnVRx_qb5C-AC-MwaXUULH5LVys1vFnDnEM-V-lejMrZlGT83a7v7sQX-N4L7nA

Request Chain 153

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESELRv54frFrIcuI81SsGRx8A&google_cver=1&google_push=AXcoOmSo37qsxYagiwF8DSkTTlJzA2LfJ8kK1NmIMY3GCnieZq2f5KxIHx5TxUQXJa0nY3-j3H0CNA7Xd5qHbH3uHOYLuxCCk2q_yw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSo37qsxYagiwF8DSkTTlJzA2LfJ8kK1NmIMY3GCnieZq2f5KxIHx5TxUQXJa0nY3-j3H0CNA7Xd5qHbH3uHOYLuxCCk2q_yw&google_hm=nB4fmilATsWknSXU22GKNkw

Request Chain 154

https://ads.travelaudience.com/google_pixel?google_gid=CAESEJ6F8lB9xCC0DptTivWD6yo&google_cver=1&google_push=AXcoOmTTbRhoHZE9dfORLwTFA6JnnU66aLhdNE_ZJ2ujLcgFjF1eVn7-adFHG5xndIEdxNVQ6BPhliBpHtVJqWWcT-JR-ycjt-z-AA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=zXqDAeSCS7OkZRSpLMDIxw2&google_push=AXcoOmTTbRhoHZE9dfORLwTFA6JnnU66aLhdNE_ZJ2ujLcgFjF1eVn7-adFHG5xndIEdxNVQ6BPhliBpHtVJqWWcT-JR-ycjt-z-AA

Request Chain 155

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEGPYTUQKCSNWtXBlNJ19U0U&google_cver=1&google_push=AXcoOmSRSiCEWfamhs4OuXOooV6UMKqde3WK1m0NFbANMV0TsApw29YI3khdNeysefdsQ4sKdP3bjVGYDhcmHYUtB48dXsM7Ku9b7g HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEGPYTUQKCSNWtXBlNJ19U0U&google_cver=1&google_push=AXcoOmSRSiCEWfamhs4OuXOooV6UMKqde3WK1m0NFbANMV0TsApw29YI3khdNeysefdsQ4sKdP3bjVGYDhcmHYUtB48dXsM7Ku9b7g&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=KVAxq7BbQQS1kWR_veVfQg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmSRSiCEWfamhs4OuXOooV6UMKqde3WK1m0NFbANMV0TsApw29YI3khdNeysefdsQ4sKdP3bjVGYDhcmHYUtB48dXsM7Ku9b7g

Request Chain 156

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKkuNJA4s5XBpbCMnYxDG1U&google_cver=1&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjkts8Hox23Qc0sw HTTP 307
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKkuNJA4s5XBpbCMnYxDG1U&google_cver=1&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjkts8Hox23Qc0sw&sovrn_retry=true HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjkts8Hox23Qc0sw&google_hm=HTr5qGZHXsZODGhPQtyekwYs

Request Chain 157

https://sync.inmobi.com/gob?google_gid=CAESEAnXTzsvzCPi9RaaCcntNSQ&google_cver=1&google_push=AXcoOmS1So1sLjoqqPRulxmno6CE6friCG6DzMsUGlaZZ1zCsIpXT8SQZwy87pdMvtjuV7vI3VAqwn7lbypF2IhzQOzXZi516dXypg HTTP 302
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmS1So1sLjoqqPRulxmno6CE6friCG6DzMsUGlaZZ1zCsIpXT8SQZwy87pdMvtjuV7vI3VAqwn7lbypF2IhzQOzXZi516dXypg

Request Chain 165

https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882 HTTP 302
https://cds.connatix.com/p/333934/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882&tier=1

Request Chain 167

https://capi.connatix.com/core/sync?v=333934 HTTP 302
https://capi.connatix.com/core/sync?v=333934&tier=1&final=true&ImplementationType=0

214 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/ 123 KB
31 KB 1673ms
1279ms Document
text/html 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: df949af3b40e0953d28c093ffb946fce71896c8ab99baccc3d29feed58b0757c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-encoding: gzip
content-length: 30446
content-type: text/html; charset=UTF-8
date: Tue, 12 Sep 2023 07:21:08 GMT
display: pub_site_sol
expires: Mon, 11 Sep 2023 07:21:08 GMT
last-modified: Mon, 05 Jun 2023 02:12:56 GMT
pagespeed: off
server: Jino.ru/mod_pizza
vary: Accept-Encoding
x-middleton-display: pub_site_sol
x-sol: pub_site

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 99 KB
29 KB 135ms
72ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc93113738e41bd3b9145ebb1dae96f3e55bd9f89f3bfdf1cc61889092625f64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29303
x-xss-protection: 0
server: cafe
etag: 858 / 19612 / m202309050101 / config-hash: 11314487324442825627
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 12 Sep 2023 07:21:08 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 718 KB
210 KB 61ms
28ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?cb=195-7-63
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5ab2d3fa85653d543b099ae753e3a39abe0ed6cb8f14841cd48d45f77f47e191

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 08 Sep 2023 21:06:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 294675
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oawUvDl8c8c1tZsA%2FLfnxihiMVFJP6iMNbfWptsC4M3uB%2F8JaUD5FbrhDh8pGAP%2FfJmEKH4xK5QMwkmFeZbRgbc9GUU8Z37%2Bj8JMJ735hGamueQBd35B%2F9fYaMYhnHhOdE7KL5Slb%2FSmhvk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 80566454ad0e18cb-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 styles.css
rorleggertroms.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 65ms
56ms Stylesheet
text/css 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/plugins/contact-form-7/includes/css/styles.css
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: ab21762c3f447aa08cbefd5ea3866165f925bd5058a9ae19e23721462de6fb60

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Wed, 22 Feb 2023 12:32:33 GMT
server: Jino.ru/mod_pizza
etag: "845df41-b2b-5f549172b68b7"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 1004

GET
H2 200 cookieblocker.min.css
rorleggertroms.com/wp-content/plugins/complianz-gdpr/assets/css/ 3 KB
913 B 65ms
56ms Stylesheet
text/css 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/plugins/complianz-gdpr/assets/css/cookieblocker.min.css
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 6260524246de2dd5a142f8741a0498a669f97e112f35728a39255b3850e03d66

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Sat, 22 Apr 2023 07:40:39 GMT
server: Jino.ru/mod_pizza
etag: "845f2e7-ab5-5f9e7e3df485b"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 715

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 44ms
16ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700&subset=cyrillic&display=swap

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

626c91a33d665410e0e0cfbca6f571dc84132a5271a4d8db5eab22511e031e62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 06:00:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Sep 2023 07:21:08 GMT

GET
H2 200 style.min.css
rorleggertroms.com/wp-content/themes/yelly/assets/css/ 209 KB
39 KB 126ms
119ms Stylesheet
text/css 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/css/style.min.css
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 5e3816e6f9588fe743d4c7bd7eec48714d42c568f16f1c3966b27e5e988f6943

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
etag: "845e5e9-34434-5f3af5554cb00"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 40100

GET
H2 200 jquery.min.js Show response
rorleggertroms.com/wp-includes/js/jquery/ 85 KB
30 KB 68ms
61ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-includes/js/jquery/jquery.min.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Tue, 08 Aug 2023 23:09:26 GMT
server: Jino.ru/mod_pizza
etag: "845ebb9-155ba-6027174588116"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 30343

GET
H2 200 jquery-migrate.min.js Show response
rorleggertroms.com/wp-includes/js/jquery/ 13 KB
5 KB 118ms
112ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-includes/js/jquery/jquery-migrate.min.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Tue, 08 Aug 2023 23:09:26 GMT
server: Jino.ru/mod_pizza
etag: "845ebb1-3509-602717458aff7"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 4872

GET
H2 200 icomoon.ttf
rorleggertroms.com/wp-content/themes/yelly/assets/fonts/ 7 KB
8 KB 124ms
118ms Font
text/html 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/fonts/icomoon.ttf
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 19cd449c87858951f691a5b9ba5a06c6d716025bc15b86d9294ba7f92dfae159

Request headers

Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Origin: https://rorleggertroms.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e5ec-1dd4-5f3af5554cb00"
content-length: 7636
content-type: text/html

GET
H2 200 consentsettings.js Show response
ezodn.com/detroitchicago/ 1 KB
903 B 33ms
20ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ezodn.com/detroitchicago/consentsettings.js?cb=2
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 383472db86bc19b822592340828e1a9d680ece8e6a5114eb4744351081fdea3c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 31 Jan 2023 21:15:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 7899579
etag: W/"5be-5f395d3676a80;5f395d3676a80-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=twAji7xCFpGkPZJpaCV2XjdzJgsYWnN3eCAdM6Fs4qg3p67JCNFurhUgeFxCjl2LBnlIELfmzL4UmkBPbNzHGqlDrPkt852O7VSLqwRZRL3lyjPVpINjjaFL9le4U6SIrq08Zv9wlSE%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566455be1218cb-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 logoss.png
rorleggertroms.com/wp-content/uploads/2023/05/ 19 KB
20 KB 64ms
58ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/uploads/2023/05/logoss.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: c44dcb8b2fc340e7e3b88c94c8822668326fe32cdec03d7201a3245c9903a4f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 25 May 2023 05:47:47 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "841729e-4d73-5fc7e29074cd3"
content-length: 19827
content-type: image/png

GET
H2 200 image88.jpg
rorleggertroms.com/wp-content/uploads/2023/06/ 56 KB
56 KB 123ms
119ms Image
image/jpeg 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/uploads/2023/06/image88.jpg
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: a84315d39fcf8e2f3f8c1f90b26a08c329044ffdccc5393617978d0b55be7baa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Sun, 04 Jun 2023 04:26:55 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "84172fc-df52-5fd463230ea84"
content-length: 57170
content-type: image/jpeg

GET
H2 200 image252-345x230.jpg
rorleggertroms.com/wp-content/uploads/2023/06/ 19 KB
19 KB 63ms
58ms Image
image/jpeg 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/uploads/2023/06/image252-345x230.jpg
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 3eabad87392c59d00eea74d7a1f30a25275727cabb3068a445002cd3538f7113

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Wed, 21 Jun 2023 13:00:14 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "8469f86-4cbf-5fea35941a85c"
content-length: 19647
content-type: image/jpeg

GET
H2 200 image253-345x230.jpg
rorleggertroms.com/wp-content/uploads/2023/06/ 11 KB
12 KB 65ms
60ms Image
image/jpeg 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/uploads/2023/06/image253-345x230.jpg
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 8e05b19edd1256710913ce753ee8bec113cdee2bff1fb28f9a026dfe5d12bd59

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Wed, 21 Jun 2023 13:49:38 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "8469f8c-2d90-5fea409f1ea73"
content-length: 11664
content-type: image/jpeg

GET
H2 200 wink.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 803 B
967 B 65ms
60ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/wink.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 4abae5160349b782a59a2db489454c6a8a1e1eabea8ae55f265bd99a6ed607f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e611-323-5f3af5554cb00"
content-length: 803
content-type: image/png

GET
H2 200 neutral.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 630 B
794 B 66ms
61ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/neutral.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 4aeae812fd310d50d911d180af5378a9a436ff33c4a8de6da933e6b50572a065

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e608-276-5f3af5554cb00"
content-length: 630
content-type: image/png

GET
H2 200 mad.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 950 B
1 KB 66ms
61ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/mad.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 9370adff2aa96f639d8d217bb90fd87515f03b49be1e2e3a49baee2e5e3c7402

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e606-3b6-5f3af5554cb00"
content-length: 950
content-type: image/png

GET
H2 200 twisted.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 1 KB
1 KB 67ms
62ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/twisted.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: a5cabd806694695eeb10b48b8e5b1f4499ec46c19bbae6312284f40ce4b64b81

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e610-434-5f3af5554cb00"
content-length: 1076
content-type: image/png

GET
H2 200 smile.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 700 B
864 B 67ms
62ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/smile.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: a028720a95b78e5bfe5234ef7a6a11c7e2f623a77b5a903d38dc15ca669e2865

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e60e-2bc-5f3af5554cb00"
content-length: 700
content-type: image/png

GET
H2 200 eek.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 1 KB
1 KB 67ms
63ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/eek.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 1f7ac379ead267382afe1258b1a23eb64bb01a4f320ca3f91a3220a01485ac96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e601-49b-5f3af5554cb00"
content-length: 1179
content-type: image/png

GET
H2 200 sad.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 705 B
869 B 68ms
63ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/sad.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 05b3acaeb9ac73650a865b4d6dadbc3f81c6d0ae015c455b6a7c91b4e36dafb8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e60d-2c1-5f3af5554cb00"
content-length: 705
content-type: image/png

GET
H2 200 rolleyes.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 892 B
1 KB 68ms
63ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/rolleyes.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 2becb7fb97364e92b82b3c6f729e22ce479d3c9f7bbd95a485a67dc65ab81c96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e60c-37c-5f3af5554cb00"
content-length: 892
content-type: image/png

GET
H2 200 razz.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 846 B
1010 B 106ms
101ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/razz.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: f3bc26d03dc5313b9df615fc465f58c0a197a045ad900aebf84ca6e819929ddd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e60a-34e-5f3af5554cb00"
content-length: 846
content-type: image/png

GET
H2 200 redface.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 873 B
1 KB 107ms
102ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/redface.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 2462f4d85888c4301384d028b17cf96a5e6856f9639b3a0fa98b511b3cc2b0f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e60b-369-5f3af5554cb00"
content-length: 873
content-type: image/png

GET
H2 200 surprised.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 1 KB
1 KB 106ms
102ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/surprised.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: bedbfebb1e570a307a3c53fa9922989a22aaae3602a306d66f8d1fd982496bf8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e60f-495-5f3af5554cb00"
content-length: 1173
content-type: image/png

GET
H2 200 mrgreen.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 859 B
1023 B 107ms
103ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/mrgreen.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 3aff9a1ebcc9288d03aefe8890c1c3d865fb1d51871ee9eae6ead3362b996904

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e607-35b-5f3af5554cb00"
content-length: 859
content-type: image/png

GET
H2 200 lol.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 911 B
1 KB 107ms
103ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/lol.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 4774b37c87bb7b7b1783d2d8d0132457c735d603f439199c632741c572071673

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e605-38f-5f3af5554cb00"
content-length: 911
content-type: image/png

GET
H2 200 idea.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 763 B
927 B 108ms
103ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/idea.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 5c03d27b9e5495789a06877e59880af499362ae4131c6149d0d402e147001906

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e604-2fb-5f3af5554cb00"
content-length: 763
content-type: image/png

GET
H2 200 biggrin.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 850 B
1014 B 108ms
104ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/biggrin.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 56873ac6f099b43669478195d9faf5dfa4101ea2b41b4d0655946ea5494bdf77

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e5fd-352-5f3af5554cb00"
content-length: 850
content-type: image/png

GET
H2 200 evil.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 929 B
1 KB 108ms
104ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/evil.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 03974808d96676949618718307b5644b87c29b7b5527693b56c2960e9c56af26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e602-3a1-5f3af5554cb00"
content-length: 929
content-type: image/png

GET
H2 200 cry.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 1 KB
1 KB 109ms
105ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/cry.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 82faa7a5ead139ade1fa1b11387a6dfdf881c1c3fea161df3da52a039f3662bb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e600-528-5f3af5554cb00"
content-length: 1320
content-type: image/png

GET
H2 200 cool.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 914 B
1 KB 108ms
104ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/cool.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: eaca3d36c30ebbfbf84dd9d9a319825c059384ee77801c680b530dfff2f62523

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e5ff-392-5f3af5554cb00"
content-length: 914
content-type: image/png

GET
H2 200 arrow.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 569 B
733 B 109ms
105ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/arrow.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: c06340de9f3beb799319aabe3751252dd687c2c194f44c3797afe72230192fdd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e5fc-239-5f3af5554cb00"
content-length: 569
content-type: image/png

GET
H2 200 confused.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 930 B
1 KB 109ms
105ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/confused.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 45e054e49a9307a05ee5b7b58684a41329a4e4ef50e773a5deacee6ce038b25e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e5fe-3a2-5f3af5554cb00"
content-length: 930
content-type: image/png

GET
H2 200 question.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 494 B
658 B 109ms
105ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/question.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 87722fdd07e2f4e3f2c1c284243c530b0a65a3b7d5dadb6fe682c8ca1f6d9bce

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e609-1ee-5f3af5554cb00"
content-length: 494
content-type: image/png

GET
H2 200 exclaim.png
rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/ 700 B
864 B 109ms
106ms Image
image/png 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/images/smilies/exclaim.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 1da222840d0c513869093c5d892419db13bdbe9b2ee5a64ed96249edcfbca5b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "845e603-2bc-5f3af5554cb00"
content-length: 700
content-type: image/png

GET
H2 200 index.js Show response
rorleggertroms.com/wp-content/plugins/contact-form-7/includes/swv/js/ 10 KB
3 KB 59ms
59ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/plugins/contact-form-7/includes/swv/js/index.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 23bb39b607b39a93d953762d2a618a3cbc69c52ceaf70d96890137ca1d2b0228

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Wed, 22 Feb 2023 12:32:33 GMT
server: Jino.ru/mod_pizza
etag: "845df47-2945-5f549172b6c9f"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 3040

GET
H2 200 index.js Show response
rorleggertroms.com/wp-content/plugins/contact-form-7/includes/js/ 13 KB
4 KB 58ms
58ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/plugins/contact-form-7/includes/js/index.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 8bac631dfefdb96cf5526520c21e9ef3f585bba973970a7e62b10c945741105c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Wed, 22 Feb 2023 12:32:33 GMT
server: Jino.ru/mod_pizza
etag: "845df3d-3294-5f549172b64cf"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 4184

GET
H2 200 scripts.min.js Show response
rorleggertroms.com/wp-content/themes/yelly/assets/js/ 49 KB
9 KB 62ms
58ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/themes/yelly/assets/js/scripts.min.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: c544f4dc829eeca25b99a219eac92840ae7372c159a4321266ad45de202d96f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Thu, 02 Feb 2023 03:41:00 GMT
server: Jino.ru/mod_pizza
etag: "845e616-c40c-5f3af5554cb00"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 9483

GET
H2 200 comment-reply.min.js Show response
rorleggertroms.com/wp-includes/js/ 3 KB
2 KB 65ms
59ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-includes/js/comment-reply.min.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Fri, 08 Apr 2022 20:07:18 GMT
server: Jino.ru/mod_pizza
etag: "845eb03-ba5-5dc2a2438e980"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 1351

GET
H2 200 complianz.min.js Show response
rorleggertroms.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/ 38 KB
10 KB 110ms
107ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: b179b4a41f42f40b4efba5dbd5a78f47b36a2d3471a9be40aea87913865abba7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Sat, 22 Apr 2023 07:40:39 GMT
server: Jino.ru/mod_pizza
etag: "845f6d6-97a0-5f9e7e3e19638"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 10238

GET
H2 200 akismet-frontend.js Show response
rorleggertroms.com/wp-content/plugins/akismet/_inc/ 10 KB
3 KB 110ms
61ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/plugins/akismet/_inc/akismet-frontend.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Wed, 22 Feb 2023 11:15:52 GMT
server: Jino.ru/mod_pizza
etag: "845db22-29ed-5f54804e76dad"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
content-length: 3086

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 109 KB
43 KB 43ms
15ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9ac858813d7cc5e56435c438fa14b9e11a00d40cc57b0a23029a768e0d4248af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43705
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 06:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 12 Sep 2023 07:21:08 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 264 KB
89 KB 57ms
29ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-ZWGQ0D0G8M

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f3b4e8241df13ed9ad6aef8520de1cf4af8a1c518f99353f6ad840f2e0219e6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 90773
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 12 Sep 2023 07:21:08 GMT

GET
H2 200 v.js Show response
g.ezodn.com/cmp/v2/ 5 KB
2 KB 26ms
17ms Script
text/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezodn.com/cmp/v2/v.js?v=4
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dce8ae752b8ed25d878707381a347b8889bfde191cd468eac141c5526a1f13dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 14:50:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1625600
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=itIQE3Bx2aOt%2F%2FqOHb0OSuBCwwldT%2FfbcZ0tfpPW%2B9zsa%2FlJ9sMfyzSTrrX6Y9mLrhadUBtTbM8iAjjoXSW%2BTaargrIcDOpvV3HMjc1h6fcUTLVG2IIxJTE1kZ%2BbxbMxGeq1U%2BGPCqdAjg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=15780000
cf-ray: 80566455be0f18cb-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 boise.js Show response
go.ezodn.com/detroitchicago/ 673 B
721 B 18ms
15ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/detroitchicago/boise.js?gcb=195-7&cb=2
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6fa04d8b4b07ebd5ebb250e33b532615e80dd02d46afb5cc0654c3c128b1c427

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Feb 2023 08:21:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 19263594
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vxJWRJ%2FqsDhLW20ZQg2g8%2B8L97aq4GkuewbyzKetckgdSkL%2B2yn0DpcCC8sD8ebNAREL3IKj3BVOcwO%2B1hdyDDJhSJgLhazISMWt9UxrBOAWymfUCxM4dMPn19vliPJ%2FGUJyNN21RZVaH5Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566455ae0118cb-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 banger.js Show response
go.ezodn.com/porpoiseant/ 55 KB
15 KB 20ms
17ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-7&bv=265&v=83&PageSpeed=off
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b03ee3c23565ae029ef3a8a1d0aa7edbd9a799fbe00ba6a8c5b38964dfc99f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 11 Sep 2023 18:53:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 44820
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CMItiEcfPBfupglIqnn%2BjsRevU92KE%2FpeJim3a0fLT6UCRWq7GJagSwVjT8UF9dLpqpyGXcbfG0c%2BEN0Egj3iw4Bktdz1I%2F3KJ2e7o3NnPmA6n0kBXJpZ2UX0QzGJXnSJtow%2B4cvxXdPRCs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566455ae0318cb-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 abilene.js Show response
go.ezodn.com/parsonsmaize/ 6 KB
3 KB 18ms
15ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 551bdca6b0b113022e76ca6863c5f58760ef372d7dba93b7e256591f6421250a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 31 Aug 2023 01:54:47 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1055345
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=54ZKms2GPIIzqQPUcGkip3dawAb%2FFNxs3e4YSI7OnqOZn3WBIJRVQ5%2BDxhjDTZXDGuZtkLzs8wCysqjeU9diRF7WTxuDZ2apkOAXCQgwEJ66Mzm7Me8NOoJg%2B%2Frq4JqY9z1g%2BA3JEtoMC9k%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566455ae0418cb-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 et.js Show response
go.ezodn.com/porpoiseant/ 1 KB
878 B 18ms
15ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/et.js?gcb=195-7&cb=2
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c34f09169d2a10e8f5863960e81575ab70f88b52f4bd3386ce5e41e73a94487

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 29 Aug 2023 18:11:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1169817
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sx2TZkQRvnkm6L5i%2BvPuYVmGu%2FFRYMqN0Vmls1IhsvbpCE2pS7mkRYXoP1624sNThen1EBTTHOZP5D1UoGDQU7v0Z0x3%2Bd8aIPg8QDn00ktu82Al9Aei2mv2CxJ1GdRDFrBvUmaedpvNFTs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566455ae0618cb-FRA
alt-svc: h3=":443"; ma=86400

POST
H2 200 dynamic Show response
go.ezodn.com/ezais/ 167 KB
32 KB 295ms
281ms XHR
text/plain 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/ezais/dynamic?cb=1
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b1113404ecd42d9bff312e1f2256a205b1c54f3b98b8955bfdb6228b67dc3ed

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://rorleggertroms.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nKuqeZPu0MlM0kfbU7bFx5Jn4lx8TQupkjapYnrTBQ18PpIX17bygxFeqzL6lp%2ForOuHSZg95%2FIgBRF24sbXuK1%2FXe%2F%2BiqTfZjIeroje0eV0lYhK%2BmPLdV6EWOmeyJTKCHLbyrEqt8UEZaQ%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
x-robots-tag: noindex
access-control-allow-headers: Content-Type
cf-ray: 80566454c8cc30f9-FRA

GET
DATA 200
OK truncated
/ 290 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b99d7ea2586a0de0fdb12cd7c01e43e0e4eac22c9f33b41161cdc84b1dda8c4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 442 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6471b88d45d9936a2b8d2fa6b9f512f1df1c54aa1e4a76f25cacb94a0332786e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 544 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b15a7416bc1f6771fb565f8fb122e4276ee563dbac2f9625962f352983c8d52

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: daa700ae30c0d44164f3ac9dd254f381c59d2f89ec914b0be6168dd6fc42d60e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8cd96c8ee4291db80ed9a8cc880ce6545d1e1897210cf2adf049291ccbcaa651

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 624 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1ba4c0ba9bdb9ae1af9cc48965b29f9c840635586e874400825eb020de1b9370

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ed69952ffe348c2f6bec16a4dd69124682771284fbef5b36b71e04c4c3c14873

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 730 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a22b8550806fe15b9a13c50cd4e95223df9579a533704f2fe40929674888fb2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 27ms
6ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700&subset=cyrillic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://rorleggertroms.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Fri, 08 Sep 2023 04:06:52 GMT
x-content-type-options: nosniff
age: 357256
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Sep 2024 04:06:52 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 28ms
8ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C400i%2C700&subset=cyrillic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://rorleggertroms.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Sat, 09 Sep 2023 13:37:19 GMT
x-content-type-options: nosniff
age: 236629
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 08 Sep 2024 13:37:19 GMT

GET
H2 200 pexels-cottonbro-studio-4855376-100x100.jpg
rorleggertroms.com/wp-content/uploads/2023/05/ 4 KB
4 KB 78ms
60ms Image
image/jpeg 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rorleggertroms.com/wp-content/uploads/2023/05/pexels-cottonbro-studio-4855376-100x100.jpg
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 66942ef0fca01f72b5d75f7d9b1a635d2b61be546dda900186f6970c8064bb96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
last-modified: Sat, 20 May 2023 13:43:18 GMT
server: Jino.ru/mod_pizza
accept-ranges: bytes
etag: "8469913-e2e-5fc20385c5c5d"
content-length: 3630
content-type: image/jpeg

GET
H3 200 mulvane.js Show response
go.ezodn.com/parsonsmaize/ 1002 B
1 KB 16ms
16ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/mulvane.js?gcb=195-7&cb=5
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2e858e11bbfe82d0150dd8fc768dfdb4577415c0ee84435e0d6c51a50e6cb64

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 05 Sep 2023 23:23:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 547075
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HKjJVmt4mVOSJpj%2BCHWMwAR5dodbOuBt4SHELBsrQ8NTX8w0lEYFhW%2BiC9s%2BGWzJeXPtDcYSZXqVf0xpg%2B1cejQxnDTMuY6sH%2B7ATgQsBZihouOQ4U5SsvKsHQEtLnln%2BTJKvh81suvA0e0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 8056645608db39c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 raleigh.js Show response
go.ezodn.com/detroitchicago/ 1 KB
1 KB 19ms
17ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/detroitchicago/raleigh.js?gcb=195-7&cb=6
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 30887d75ca7268ceabc93067bca019f8ffe07189630a759407b236736e1f15af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 01 Feb 2023 05:22:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 19274322
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AfRpupHuBI4%2BhdeHS2s3K3oS9kCnleqF3ddXNO%2Fumo0f733eJZKP4xKtb0gJCGp5qYE7HdMLRbeMbBstGzRyfFFs6MZ5713N%2FHPw9wvr2XuQaAaOZLJPW6VL5w6DM7IXU6NKKRYtKouivO8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 8056645608df39c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 vista.js Show response
go.ezodn.com/detroitchicago/ 821 B
926 B 16ms
14ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/detroitchicago/vista.js?gcb=195-7&cb=5
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f511fa7924776077436e0e7c47d96a420282192ee4f9c5dc96def26cb856c709

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 29 Aug 2023 18:06:36 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 1169831
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w5II3BRKf5ne8%2BtWJihDnpAXNBM2dXijpuiI0SOX6YtRkxSTlxLSRCks3%2BLpGSARdjF7IQM9CkuI44YY4%2FnAUnrZMOZo%2B4VNShweODx7%2FL3V54L7GRic2yzeXJ4RxKduiGhvgeiHvB70u1s%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 8056645608e139c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 tampa.js Show response
go.ezodn.com/detroitchicago/ 723 B
877 B 17ms
15ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/detroitchicago/tampa.js?gcb=195-7&cb=5
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e611f58b19c2ff6aba81588e7b0a148e523d8acbadc40092f8de5f50dca2f93c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 05 Feb 2023 00:24:52 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 11889795
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fU2yBykf6riti%2F5FzMx5UrT%2FFyW6Ds4wVJvADSoMjB9KV0yUiS8O8L8nbILMP3x5neoMm7CiM1uGxzhsle%2FnXUHrhnzmZ9hdU02Iq7oJxx3XIcAoG9pGav21t9eFrmdFCdVwEN3MssCioY4%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 8056645608e439c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 nmash.js Show response
go.ezodn.com/porpoiseant/ 64 KB
23 KB 31ms
24ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/nmash.js?bv=265
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-7&bv=265&v=83&PageSpeed=off
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 70a0d014733bcc7b6557c7dd764593432936ccc0e75d827ce94f2fff138afa8b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 11 Sep 2023 18:51:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 44978
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4FCur1bR0BGfC%2BIBT3k%2FHvS1joB6JvSbAsUYE6cTxXIlvTpYc3OHvAtDLEBbs4bZI3%2FHcqIeVBBqzLCLJF1MuaQfFw7EQ66iau8C6kinVQbkoBsOlSL0tScaFcKoKlIKJoOIsLf2599xtJ0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 8056645618f039c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
bshr.ezodn.com/ 9 KB
5 KB 15ms
14ms XHR
application/json 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bshr.ezodn.com/?did=466107&bf=30000&dc=%7C1254144
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/porpoiseant/banger.js?cb=195-7&bv=265&v=83&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9343627a013971254ab1c26091c9e4ccbb08c93bcf7908d9eefb787255bdd6c5

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
X-PINGBACK: pingpong
Content-Type: application/json

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 333375
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 07 Sep 2023 08:37:14 GMT
server: cloudflare
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: application/json; charset=utf8
access-control-allow-origin: https://rorleggertroms.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Hjj7MlxXN7N%2FIx9dVvggGf8pOoaNkBIJPGrC0yfkrp%2FVWslAIvKkMcUB0C3Lk1JYJf8u7CbFkxc1EWOlJXZjDDDu4GDcGxfYouZj3dEuZ2U0j0q7%2Bhkyhn3nGsfCHQomOFcrH3wpOAkg3arKWw%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: private, max-age=1209600
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
cf-ray: 805664564aa830f9-FRA
access-control-allow-headers: Content-Type

OPTIONS
H2 200 /
bshr.ezodn.com/ Frame 0
0 36ms
21ms Preflight
text/plain 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bshr.ezodn.com/?did=466107&bf=30000&dc=%7C1254144
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-pingback
Access-Control-Request-Method: GET
Origin: https://rorleggertroms.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-pingback
access-control-allow-methods: GET, POST, PUT, OPTIONS
access-control-allow-origin: https://rorleggertroms.com
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 805664562a6c30f9-FRA
content-length: 0
content-type: text/plain; charset=utf-8
date: Tue, 12 Sep 2023 07:21:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZyMQK1s2oGZz%2FVUXGcJ69BgahlJlybykqGk2VxXNwGQYJu8qwyWkU2IGTjHOfYjRecV%2FNLbXUsG53q7jb9KZ1nzWBzdkU3GDCg%2Fd1DnoqOC81lBOKdlR3ko4OeVJ6GOa1yV%2FXMZF7BqsgCy5Sw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers

GET
H2 200 tag.js Show response
mc.yandex.ru/metrika/ 202 KB
70 KB 242ms
124ms Script
application/javascript 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/metrika/tag.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

92d967aa9f47d13c45fa328edf25255a86f1b4cabf5673a516166a274da4c235

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Thu, 07 Sep 2023 11:49:37 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "64f98ea1-11420"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 70688
expires: Tue, 12 Sep 2023 08:21:08 GMT

GET
H3 200 jellyfish.js Show response
go.ezodn.com/porpoiseant/ 37 KB
10 KB 18ms
18ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/porpoiseant/jellyfish.js?a=a&cb=10&dcb=195-7&shcb=34
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8bda09f8b4ad205fc0c53b850c619c4496a25ef3fd2ff094cfb261316d00fca1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 09 Sep 2023 00:33:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 263805
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B4oziNB1RvgZ2BahKrcTtP1nNwPnAVVtH6NkZYH3uFYBV8HWSQp%2BtG71YP%2FaO54aJSvBPe1C4S8muEsLv003O0rG1tYhP6Sn5MRcXI3GZT5oJcJAsxtKtNWQMNTT%2F55LbCJ48cCTVwo04Cc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566456391b39c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 drake.js Show response
go.ezodn.com/beardeddragon/ 4 KB
2 KB 22ms
21ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/beardeddragon/drake.js?gcb=7&cb=4
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 87143a6e228aa2039004935d4159d5e1e8ff3b6762e2d5ceeab72c04f0fb178f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 11 Sep 2023 23:34:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 27754
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UQRH7fqSh%2F2T17LiTTFAFrzbtjLTbkOGzH%2BOv9dFl3vBFJmk%2FzYgWgPiCB2Iid7kc4q1LK2ogr3QIENA%2FSM1w4GxXE43aj41sJUopPRCjr63dLsxXWUEr9ksCGrrwJPU3XwQMMkmzFsyhIs%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566456391d39c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 olathe.js Show response
go.ezodn.com/parsonsmaize/ 2 KB
1 KB 17ms
17ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/olathe.js?gcb=195-7&cb=19
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c0d7410d5a609344ffe86a71c14012be3aa5a299cfc0ee13aad39dcad2cbe95a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 31 Aug 2023 01:54:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 365734
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cPcPoPZ%2Bb9wgyk6ojzeAEUZF0ao0J14mTnt0cPSzV%2Behfd21ZxlxqX4MjKqbxCRa8ji%2B1oZhAnjQ4EAYdRyfObN1jbSwAqwY0rmmk90hTxmT%2B7xdXFecGK%2BhFvaKH%2FsQXKStWB24KlIp5TA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566456896d39c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 chanute.js Show response
go.ezodn.com/parsonsmaize/ 21 KB
6 KB 18ms
18ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/parsonsmaize/chanute.js?a=a&cb=4&dcb=195-7&shcb=34
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bbb126b9e8714be02d4544356d79477cf8ff397bf1cc527ac6c353d4c9084dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 09 Sep 2023 00:27:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 281769
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JFKUM2JijeyOvpk62F1a7XH5eQfjmPERnnBjXhrQEte%2BJQQxKkXfHuP5FcHynLucPq%2BNXXGh%2FNl2mlg3zXotYDGpXC5kPFQsFFRMESgIIQT7EFjaToKaycVzAllwhurKMUduDW8rkdgVm78%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566456897039c7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 vitals.js Show response
go.ezodn.com/tardisrocinante/ 5 KB
2 KB 15ms
15ms Script
application/javascript 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/tardisrocinante/vitals.js?gcb=7&cb=3
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb27c6cd026e3f4d11ad71f549bcf89e80f029df5ea759589fd23fa62687f14d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 11 Sep 2023 23:34:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 27754
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cojRllE%2FjhqlQM6xRZkg1Q6JFkszm%2FiCW4Zsmwr%2Bo07LzIUi6wG7LYwjzEhI3ei82wsHrYykydjjRb8kRH3dNCj6jPw3gZqFnSOUVGWhAkfLZSE0E7hdgfLCUYhNfsRvZqMAqLyHZAdjr64%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: public, max-age=31536000
x-robots-tag: noindex
cf-ray: 80566456897139c7-FRA
alt-svc: h3=":443"; ma=86400

POST
H2 204 collect
region1.google-analytics.com/g/ 0
256 B 36ms
15ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-ZWGQ0D0G8M&gtm=45je3960&_p=531990159&cid=1589597657.1694503269&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1694503268&sct=1&seg=0&dl=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&dt=Betaler%20du%20husleie%20for%20sent%3F%20Finn%20ut%20konsekvensene!&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-ZWGQ0D0G8M
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:08 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 fads.js Show response
rorleggertroms.com/porpoiseant/ 11 KB
3 KB 1277ms
1277ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/porpoiseant/fads.js?gcb=195-7&cb=56
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 50f5f3646e69df042af1e9329a10076b4b5135bdff64eadb6a4b5aa3393b89a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 3101
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 reportads.js Show response
rorleggertroms.com/detroitchicago/ 3 KB
1 KB 1115ms
1114ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/detroitchicago/reportads.js?gcb=195-7&cb=1
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: f35c7765f35ee933039a37294e629364b5907a06da6b899121be26a89089667a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 1182
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 tortoise.js Show response
rorleggertroms.com/beardeddragon/ 3 KB
2 KB 1159ms
1158ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/beardeddragon/tortoise.js?gcb=7&cb=4
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 2ea07afd59f660225e82c177586447bf9960c48e6b1beb9b810e27a0be16ed9a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 1467
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 armadillo.js Show response
rorleggertroms.com/beardeddragon/ 3 KB
1 KB 1102ms
1100ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/beardeddragon/armadillo.js?gcb=7&cb=25
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 270d68c001d05e764b3ccd047bedf93a8376bfd08b44124a67b9fa31e335cea8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 1110
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 denver.js Show response
rorleggertroms.com/detroitchicago/ 989 B
847 B 1191ms
1189ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/detroitchicago/denver.js?gcb=7&cb=3
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: f57a02f763b3cc6b279df2da01ff30a52873588cc9b356eb5ab4e5f10381119a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 561
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 turtle.js Show response
rorleggertroms.com/beardeddragon/ 30 KB
10 KB 1287ms
1285ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/beardeddragon/turtle.js?gcb=7&cb=26
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: b56177bbf63fcddb09036efc3e291b1546b90a1aea07dc168229ecf7ad2b1e6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 9668
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 wyvern.js Show response
rorleggertroms.com/beardeddragon/ 657 KB
189 KB 2574ms
2572ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/beardeddragon/wyvern.js?cb=75
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: eba023a12435106e1574220485be8a3fa2215eac4fbc08233808cec8ac548ecd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 358 KB
124 KB 66ms
15ms Script
text/javascript 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13c151da3c1ba1beea84e45b9a7f92f2b553c26c07615626a55745d5595cd42f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126089
x-xss-protection: 0
expires: Tue, 12 Sep 2023 07:21:08 GMT

GET
H2 200 anchorfix.js Show response
rorleggertroms.com/ezoic/ 879 B
736 B 2275ms
2273ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/ezoic/anchorfix.js?cb=22
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 15f0626dd31e3e991a1c21d6304f2e370b92b3c91650de3d7ed8a38f1159a457

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86400
x-robots-tag: noindex, noindex
content-length: 465
expires: Wed, 11 Jan 1984 05:00:00 GMT, Wed, 11 Sep 2024 07:21:11 GMT

GET
H2 200 sidebarwall.js Show response
rorleggertroms.com/detroitchicago/ 9 KB
3 KB 2516ms
2515ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/detroitchicago/sidebarwall.js?gcb=7&cb=19
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: c27c396b7f4c1ff33d934d2c66f082c7f81193203971648a114f862c9143c234

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 2672
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 kenai.js Show response
rorleggertroms.com/detroitchicago/ 3 KB
2 KB 2436ms
2434ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/detroitchicago/kenai.js?gcb=7&cb=6
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: ec734543fdd76f27824d57c3b4db2222d85365a0822a4df1e1620185963dedd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 1258
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/162833/9311/ 519 KB
161 KB 63ms
14ms Script
application/javascript 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c47bbdc39af7f5ac31d9f494ef999067da7cb95cf85e69a9446792ebdc67582e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
content-encoding: gzip
last-modified: Fri, 11 Aug 2023 20:34:51 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=73092
accept-ranges: bytes
content-length: 164367
expires: Wed, 13 Sep 2023 03:39:20 GMT

GET
H2 200 tuscon.js Show response
rorleggertroms.com/detroitchicago/ 7 KB
2 KB 2729ms
2728ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/detroitchicago/tuscon.js?gcb=7&cb=12
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 2035
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 portland.js Show response
rorleggertroms.com/detroitchicago/ 32 KB
11 KB 2672ms
2671ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/detroitchicago/portland.js?gcb=7&cb=33
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: e41cfe6a26a363a2a8e08c5f604f7b1c44ec102e8ce2a46b835bfa989a6ec3be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 10887
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 augusta.js Show response
rorleggertroms.com/detroitchicago/ 3 KB
2 KB 3399ms
3398ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/detroitchicago/augusta.js?cb=43
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: c0b88250724cc39a8ae30f5fb5de729cfbbbab2fe8edb77b3796c97d482ed1f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 1260
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 banner-1-optin.css
rorleggertroms.com/wp-content/uploads/complianz/css/ 15 KB
3 KB 2428ms
2427ms Stylesheet
text/css 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/wp-content/uploads/complianz/css/banner-1-optin.css?v=13
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/wp-content/plugins/complianz-gdpr/cookiebanner/js/complianz.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 988f4e8479084fd570d6c45f1aba6e511efa56bd76e2ca351265e20ca49222a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-encoding: gzip
last-modified: Thu, 25 May 2023 05:58:11 GMT
server: Jino.ru/mod_pizza
etag: "8464545-3ab9-5fc7e4e324cca"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes
content-length: 2854

GET
H3 200 ezoic.png
go.ezodn.com/utilcave_com/img/ 1 KB
2 KB 31ms
31ms Image
image/png 2606:4700:e2::ac40:8817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezodn.com/utilcave_com/img/ezoic.png
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:e2::ac40:8817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:08 GMT
cf-cache-status: BYPASS
x-sol: middleton
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
x-middleton-display: staticcontent_sol
alt-svc: h3=":443"; ma=86400
content-length: 1181
last-modified: Thu, 03 Mar 2022 21:54:00 GMT
server: cloudflare
etag: "49d-5d9576f862e00-gzip-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uOagiIHzpP8kcCivuqNBsPJWPN8ywdKvZlta9swy%2ByPqa5yFn8eoNpZ0mm01l6PRQ7IvRHOt0dVtUza8%2BXJC%2Bnak1IVsyW8i5G9CptzhdwjLctbnYUfZfFOZ6691SYmuQnDPNgFhyVtBvTc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=604800
accept-ranges: bytes
cf-ray: 805664570a1e39c7-FRA
expires: Tue, 19 Sep 2023 07:21:08 GMT

POST
H2 200 imp.gif
g.ezoic.net/detroitchicago/ 43 B
336 B 47ms
13ms Ping
image/gif 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/imp.gif
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
content-encoding: br
access-control-max-age: 1728000
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
access-control-allow-headers: Content-Type
content-length: 47
expires: Mon, 11 Sep 2023 07:21:09 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/ 404 KB
127 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84f17c357a114f92f5594d1254ef145103bd25fe28a365fc648d27678f91cdfc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 06:36:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2664
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 129878
x-xss-protection: 0
server: cafe
etag: 7992010681825974757
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 11 Sep 2024 06:36:44 GMT

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 32ms
15ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 40788
x-jsd-version: master
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230042-FRA, cache-jnb7027-JNB
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tJrSoAjuOPnVZzW6LlVS8gyNh3vbnfiWQM7PtyClZeqxV08RXNcKn65kRomGXVkx1NBHczQ8gjJ4kxz29bROHkviIZEk6xE%2BGTqisVmR8xM%2BtQJ%2Bvif%2F%2BqeQ6eqEC6wjLJtFq1ROibxuWLqwdlQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 80566457dc35916b-FRA

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 139 KB
31 KB 45ms
20ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccebb3668d65d3268223556ecdbe14e98305dd0abeffe6308c75e7fb21188fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 08 Sep 2023 09:30:49 GMT
server: cloudflare
x-amz-request-id: MWKYM1T9JX7HPNB6
age: 3239
etag: W/"1a5f44cdb786ba83a7fa05963228f464"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 80566457ec576925-FRA
x-amz-id-2: pY6p/oR/2+42bVL00JT3+C3IDDYMcwXtdBkjms7Ftfj6yuck6lNYOYLZZtmAz8t1unTNOkNx5/Y=

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 48ms
27ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: c3ce018c4b2dec64ee35c283a7b0e5fc
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 31ms
6ms Script
text/javascript 18.66.97.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-88.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 02:44:08 GMT
content-encoding: gzip
via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P2
age: 16622
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: -s6cIEboMr7u5kLOulfyAsenaHFXeb5ofGQyDQy4zC6-ztNBwYxWnw==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 53ms
7ms Script
text/javascript 2600:9000:2250:4e00:a:e047:753:6381
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:4e00:a:e047:753:6381 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

x-amz-version-id: tte_Zq9MCmRAYf9XeFwo9sUIgrBbXCUY
Date: Tue, 12 Sep 2023 04:57:50 GMT
Via: 1.1 d4f777a2d5a6d5aeb7eb6201b41775ea.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P2
Age: 8600
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Wed, 06 Sep 2023 03:40:59 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: 9Wy6FovzeXNJqyU3p1IK7gslAh0ML9njq-Mg6pgwG7-IgjB_0bg1FA==

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 28ms
7ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Sun, 27 Aug 2023 02:29:26 GMT
content-encoding: gzip
age: 1399903
x-guploader-uploadid: ADPycduOKtZ-jYI708NlmmpGXaU-NamfOkJWG4viTvwKHJcmSy94qlD08CPlfYu_2RHuf9tKSr4DZ6TG98ZrmcQ41lZhQQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Mon, 26 Aug 2024 02:29:26 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 43 KB
14 KB 54ms
20ms Script
text/javascript 2a02:2638:d::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c746ca687b3e79023240e45eb684f036fd9a1312b454758a6018b3ece635dafb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 07 Sep 2023 09:22:37 GMT
server: nginx
etag: W/"64f9965d-ab99"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 13 Sep 2023 07:21:09 GMT

GET
H3 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 33ms
19ms XHR
application/json 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20230912

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2fbbf1f616091d16a20443f2fa2ffa462f075d3d803dd87d20c02aac24e5da4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 12015
x-jsd-version: 1.0.1810
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230103-FRA, cache-yyz4568-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"63f-ujPp1VkgTYBbdaXL3bnAAK2Hw+s"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IiVOjh7e%2FzfyIyKwoGBl12%2F%2FYwR3y04Fg4vwmXa1d0JvTTPHkDQq7sEUeozqscWBNNghZo6lJgawkBTS%2B2u%2BVRjyHH5l9G1wM5qYKYyj8pGD5AvC%2FqnRbXTXb5NLvHgSCdKeRnXMaodbyZIWANg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8056645808d04d59-FRA

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 779 B
437 B 556ms
556ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2540473449255237&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=1&didk=3995623278&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1694503269116&lmt=1685923976&adxs=1050&adys=193&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&vis=1&psz=336x294&msz=336x280&fws=4&ohw=1600&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcY0-WPwqgxSABSAghkEhcKCHJ0YmhvdXNlGNPlj8KoMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSFAoFb3BlbngY1OWPwqgxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjT5Y_CqDFIAFICCGQ.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5176630652180546%26eid%3D5176630652180546%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Drorleggertroms_com-box-1-5176630652180546%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26bv%3D30%26bvm%3D3%26bvr%3D4%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747&adks=3322963612&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2092a90c5495f6f1b09cda9d3b3fd15aea2803a7199c17673bebe41d724795bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 406
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 17A2 6 KB
3 KB 69ms
14ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://rorleggertroms.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Sep 2023 07:21:09 GMT
expires: Wed, 11 Sep 2024 07:21:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 638 B
309 B 582ms
582ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1506340805110316&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=2&didk=3996782115&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1694503269129&lmt=1685923976&adxs=251&adys=1147&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&vis=1&psz=730x90&msz=728x90&fws=4&ohw=1600&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcY0-WPwqgxSABSAghkEhcKCHJ0YmhvdXNlGNPlj8KoMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSFAoFb3BlbngY1OWPwqgxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjT5Y_CqDFIAFICCGQ.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

065d9427c9bd65f414d9c04f9a58a6d42aedeea64ba139fd0c1beaa30b40c368

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 278
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 647 B
318 B 537ms
536ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1171001931781983&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=3&didk=2321484075&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1694503269134&lmt=1685923976&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcY0-WPwqgxSABSAghkEhcKCHJ0YmhvdXNlGNPlj8KoMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSFAoFb3BlbngY1OWPwqgxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjT5Y_CqDFIAFICCGQ.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D1461121202219410%26eid%3D1461121202219410%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Drorleggertroms_com-medrectangle-2-1461121202219410%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26bv%3D0%26bvm%3D4%26bvr%3D4%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D100%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747&adks=3250143347&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f6c6e333951f89d24a33bc7062a6946d79dae6ec80815a482b49d2d0ea036cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 287
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 640 B
312 B 718ms
718ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3441333969277155&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=4&didk=2366647195&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1694503269137&lmt=1685923976&adxs=0&adys=304&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcY0-WPwqgxSABSAghkEhcKCHJ0YmhvdXNlGNPlj8KoMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSFAoFb3BlbngY1OWPwqgxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjT5Y_CqDFIAFICCGQ.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2430424402217963%26eid%3D2430424402217963%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Drorleggertroms_com-edge-1-2430424402217963%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26bv%3D25%26bvm%3D1%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747&adks=2503113591&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccde2d5ac6139b97afacb4becc4bd7aa254349c54b9a3c7ad176060e8d226c9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 638 B
308 B 512ms
511ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1297449992008301&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=5&didk=3995605495&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1694503269140&lmt=1685923976&adxs=251&adys=193&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&vis=1&psz=730x90&msz=728x90&fws=4&ohw=1600&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcY0-WPwqgxSABSAghkEhcKCHJ0YmhvdXNlGNPlj8KoMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSFAoFb3BlbngY1OWPwqgxSABSAghkEhsKDGlkNS1zeW5jLmNvbRjT5Y_CqDFIAFICCGQ.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

51538185c2e4c9ba2d3c6ecf161318bcaaa25346288139699212d210d23339de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 277
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 400 / Show response
ow.pubmatic.com/cookie_sync/ 120 B
266 B 93ms
19ms XHR
text/plain 185.64.190.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL

https://ow.pubmatic.com/cookie_sync/?sec=1

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.64.190.84 , United Kingdom, ASN62713 (AS-PUBMATIC, US),

Reverse DNS

Software

Resource Hash

b6e7aed079d176a0b4dac32e74a1550cb2b219410d5d9bf62295982337ae9b67

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://rorleggertroms.com
date: Tue, 12 Sep 2023 07:21:09 GMT
access-control-allow-credentials: true
x-content-type-options: nosniff
content-length: 120
content-type: text/plain; charset=utf-8

POST
H2 200 auction Show response
ow.pubmatic.com/pbs/openrtb2/ 246 B
332 B 107ms
41ms XHR
application/json 185.64.190.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://ow.pubmatic.com/pbs/openrtb2/auction
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.190.84 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 555628ada0ae304c558c5f3f9fba3c34a878ca8e7378fb969b225d5a084db2fc

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://rorleggertroms.com
date: Tue, 12 Sep 2023 07:21:09 GMT
access-control-allow-credentials: true
content-length: 246
content-type: application/json

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rid=esp&cc=1

85 B
203 B

118ms
117ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rid=esp&cc=1
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: ef6bb9abe3f4d16593818c76c607c4671a5ccf46231d128f99e4fe2bef930de2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-9PZoNnbMAJX51DLeY8oxyDKaZkY"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://rorleggertroms.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Tue, 12 Sep 2023 07:21:09 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://rorleggertroms.com
location: /esp?url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

sync_cookie_image_decide
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10124.wvhYnLpiAQ8vSqVvnEp8Oq3VV72yRglfPeMJWkUYS-Tdkpm98finRCkA2fvfyE_t.xC019RAi9a6iqcldZrlzgkueGqk%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10124.UYbkI5_1PlVf11fI6Z6tVMXkLuJObj5iKJlT7juKRMDFrg3PxpPMMTi9cDNF3T6Z3gBoDOk-iToZ0IJuvH9QyrmVH7LQR_oa6mzlLYBoYaU%2C.CwZqG79KErdDMoit8Ljp3A_Nzmo%2C

43 B
67 B

63ms
63ms

Image
image/gif

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide?token=10124.UYbkI5_1PlVf11fI6Z6tVMXkLuJObj5iKJlT7juKRMDFrg3PxpPMMTi9cDNF3T6Z3gBoDOk-iToZ0IJuvH9QyrmVH7LQR_oa6mzlLYBoYaU%2C.CwZqG79KErdDMoit8Ljp3A_Nzmo%2C

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide?token=10124.UYbkI5_1PlVf11fI6Z6tVMXkLuJObj5iKJlT7juKRMDFrg3PxpPMMTi9cDNF3T6Z3gBoDOk-iToZ0IJuvH9QyrmVH7LQR_oa6mzlLYBoYaU%2C.CwZqG79KErdDMoit8Ljp3A_Nzmo%2C
date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
336 B 104ms
31ms XHR
application/json 63.35.30.113
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.35.30.113 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-35-30-113.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: ce94ed50bc85b66f1f7a4ba7a1f1419f87a6cf6e9bb5b8bf3f3e4c0d80cdae13

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:09 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache
x-server: 10.45.16.71
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
138 B 59ms
59ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 07 Sep 2023 11:49:37 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "64f98ea1-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Tue, 12 Sep 2023 08:21:09 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 54A8 15 KB
6 KB 41ms
14ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=rorleggertroms.com&us_privacy=1---

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://rorleggertroms.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 12 Sep 2023 07:21:08 GMT
server: Kestrel
server-processing-duration-in-ticks: 244359
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
327 B 32ms
8ms XHR
text/plain 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://rorleggertroms.com
date: Tue, 12 Sep 2023 07:21:08 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2

200

sid Show response
mug.criteo.com/ Frame 54A8
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=rorleggertroms.com&sn=ChromeSyncframe&so=0&topUrl=rorleggertroms.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=4WQzu3xTNzllZnc4OElqdklyb21wQ3hRQXZDaUpNUlJKNmpWVDJwK3VKcUtqUGh2dUpWalNNUUpvYmVLemllLytWVGwxWFBMUTdwRTZqRVZab2ZuUmtXTnZMbTNpZnl2cWpWT1NjaEYwbEE3aWd1UnBEMzYxTGhiNTZMTU...

465 B
681 B

69ms
17ms

Fetch
application/json

178.250.7.13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=4WQzu3xTNzllZnc4OElqdklyb21wQ3hRQXZDaUpNUlJKNmpWVDJwK3VKcUtqUGh2dUpWalNNUUpvYmVLemllLytWVGwxWFBMUTdwRTZqRVZab2ZuUmtXTnZMbTNpZnl2cWpWT1NjaEYwbEE3aWd1UnBEMzYxTGhiNTZMTUV5ZForL1JoR0txcTRSVit4RWxoZnd6S0JKSzFPSDBNK1R1UGp4WlRMaWttMit5MFp6bUZJQ3lxTVVKdlRwQzNEWndOY0lCRmJJcGFmK0ZrdUUzZkhHaG5lMHVnV0Z3Uk0yMS91eVA5S0g3bkNrZGp4aG8wQ2h1ZHk3QTBBUndDallvVVpDMzg3RVMwV1llbCs1NUpBd0g5SUlSTUtMMDZaVDVNeHgwTU9ZVVIwcW16U2lFND18&cppv=2

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Server

178.250.7.13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f9eab74c794ba8a9386ec7c8de2a9e9c01b86a55e00ac6e93a5175979a089cc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1794173
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:08 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=4WQzu3xTNzllZnc4OElqdklyb21wQ3hRQXZDaUpNUlJKNmpWVDJwK3VKcUtqUGh2dUpWalNNUUpvYmVLemllLytWVGwxWFBMUTdwRTZqRVZab2ZuUmtXTnZMbTNpZnl2cWpWT1NjaEYwbEE3aWd1UnBEMzYxTGhiNTZMTUV5ZForL1JoR0txcTRSVit4RWxoZnd6S0JKSzFPSDBNK1R1UGp4WlRMaWttMit5MFp6bUZJQ3lxTVVKdlRwQzNEWndOY0lCRmJJcGFmK0ZrdUUzZkhHaG5lMHVnV0Z3Uk0yMS91eVA5S0g3bkNrZGp4aG8wQ2h1ZHk3QTBBUndDallvVVpDMzg3RVMwV1llbCs1NUpBd0g5SUlSTUtMMDZaVDVNeHgwTU9ZVVIwcW16U2lFND18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 285776
content-length: 0
expires: 0

GET
H2 204 /
onetag-sys.com/usync/ Frame 06C0 0
0 28ms
7ms Document
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1694503269296

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://rorleggertroms.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 204 isyn
prebid.a-mo.net/ Frame 52F0 0
0 55ms
13ms Document
text/plain 145.40.97.67
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/isyn?gdpr_consent=&gdpr=0&us_privacy=&gpp=&gpp_sid=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.67 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash

Request headers

Referer: https://rorleggertroms.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=0, private, must-revalidate
date: Tue, 12 Sep 2023 07:21:08 GMT
server: envoy
vary: Accept-Encoding
x-envoy-upstream-service-time: 0

GET
H2

200

1 Show response
mc.yandex.com/watch/92577418/
Redirect Chain

https://mc.yandex.com/watch/92577418?wmode=7&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq8...
https://mc.yandex.com/watch/92577418/1?wmode=7&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6q...

435 B
738 B

62ms
61ms

XHR
application/json

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/92577418/1?wmode=7&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A1936%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A177422209012%3Ahid%3A470218800%3Az%3A120%3Ai%3A20230912092109%3Aet%3A1694503269%3Ac%3A1%3Arn%3A909043950%3Arqn%3A1%3Au%3A1694503269437627901%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A269%2C124%2C1279%2C6%2C%2C0%2C%2C312%2C1%2C%2C%2C%2C2104%3Aco%3A0%3Acpf%3A1%3Ans%3A1694503266858%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694503269%3At%3ABetaler%20du%20husleie%20for%20sent%3F%20Finn%20ut%20konsekvensene%21&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

c17cf68eef9ba85c4599429e87cf2416ccaf7b72baaa84a7805490bc0625eaca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Tue, 12-Sep-2023 07:21:09 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: application/json; charset=utf-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 435
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:09 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 12-Sep-2023 07:21:09 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
location: /watch/92577418/1?wmode=7&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afp%3A1936%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A0%3Als%3A177422209012%3Ahid%3A470218800%3Az%3A120%3Ai%3A20230912092109%3Aet%3A1694503269%3Ac%3A1%3Arn%3A909043950%3Arqn%3A1%3Au%3A1694503269437627901%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A269%2C124%2C1279%2C6%2C%2C0%2C%2C312%2C1%2C%2C%2C%2C2104%3Aco%3A0%3Acpf%3A1%3Ans%3A1694503266858%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694503269%3At%3ABetaler%20du%20husleie%20for%20sent%3F%20Finn%20ut%20konsekvensene%21&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ti%282%29&redirnss=1
access-control-allow-origin: https://rorleggertroms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:09 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 621E 0
176 B 43ms
22ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://rorleggertroms.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Tue, 12 Sep 2023 07:21:09 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2

200

sync_cookie_image_decide_secondary
mc.yandex.com/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check_secondary
https://mc.yandex.ru/sync_cookie_image_start_secondary?redirect_domain=mc.yandex.com&token=10124.6D4ja9hr-kY5ZclloZbGPEnkvSJyEcApAo4eo8iQXEUaAn8GQoITJsyQiemoT0gQ.FWUsqCtT0zeem4oywVH9rgHLSy0%2C
https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10124.eseApLH7q_FHZPe8lHyABk-MDNx8iLvguz_dHPUDMbLMXfoEcfeZ0LdX9akNcVvGaXukgIN3m1bBFzJedW1Y96vgsf2iUV93mTceyCHIluY%2C.zKDnzgqiNpGtzd1FL...

43 B
79 B

59ms
59ms

Image
image/gif

2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10124.eseApLH7q_FHZPe8lHyABk-MDNx8iLvguz_dHPUDMbLMXfoEcfeZ0LdX9akNcVvGaXukgIN3m1bBFzJedW1Y96vgsf2iUV93mTceyCHIluY%2C.zKDnzgqiNpGtzd1FLugRpT1xTsY%2C

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.com/sync_cookie_image_decide_secondary?token=10124.eseApLH7q_FHZPe8lHyABk-MDNx8iLvguz_dHPUDMbLMXfoEcfeZ0LdX9akNcVvGaXukgIN3m1bBFzJedW1Y96vgsf2iUV93mTceyCHIluY%2C.zKDnzgqiNpGtzd1FLugRpT1xTsY%2C
date: Tue, 12 Sep 2023 07:21:09 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

POST
H2 204 greenoaks.gif
g.ezoic.net/detroitchicago/ 0
23 B 7ms
6ms Ping
text/plain 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkZDY5MGMzMC0yM2Q0LTQwN2YtNDQ4MC05Njg1NDI5ODRjZTciLCJkb21haW5faWQiOiI0NjYxMDciLCJ0X2Vwb2NoIjoxNjk0NTAzMjY4LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiZG9tYWluX2lkIjoiNDY2MTA3IiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMDktMTIifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiI5In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImRkNjkwYzMwLTIzZDQtNDA3Zi00NDgwLTk2ODU0Mjk4NGNlNyIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInRfZXBvY2giOjE2OTQ1MDMyNjgsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV90YWciLCJ2YWwiOiJlbi1VUyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6ImRkNjkwYzMwLTIzZDQtNDA3Zi00NDgwLTk2ODU0Mjk4NGNlNyIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInRfZXBvY2giOjE2OTQ1MDMyNjgsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiZG9tYWluX2lkIjoiNDY2MTA3IiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiZGF0YSI6W3sibmFtZSI6InRpbWVyX2ZpcnN0X2FkX3JlcXVlc3QiLCJ2YWwiOiIxMDcxIn1dfV0=&visit_uuid=NaN
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: ezp_sol
date: Tue, 12 Sep 2023 07:21:09 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Mon, 11 Sep 2023 07:21:09 GMT

POST
H2 200 wl Show response
t.pubmatic.com/ 17 B
184 B 82ms
26ms XHR
text/plain 185.64.189.226
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://t.pubmatic.com/wl?pubid=162833
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/pwt/162833/9311/pwt.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.226 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 0d111d61901004eafd87c672f12f6cd54b3c376513aa672bf58100506dfe76f5

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:09 GMT
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 17
expires: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 173 KB
51 KB 767ms
767ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3803649649213152&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-pixel1&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=6&didk=2015767493&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503269949&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=br2%3D100%26bvr%3D0%26reft%3Dn%26avc%3D100%26ic%3D1%26br1%3D160%26tap%3Drorleggertroms_com-pixel1-6789038660230411%26al%3D1006%26d%3D466107%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26ga%3D2497208%26iid1%3D6789038660230411%26bra%3Dmod228%26ap%3D9999%26ezoic%3D1&adks=4031740890&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

07a7bea0a68c2563314b2e9434ec34ceaf0d1b8d4a17f5d494dc427989bc5024

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52149
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/ 38 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d12a9bf1fe15f8267e78800c4d420cd2012119edce1c7a2734de411fbe4c336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 12:28:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67939
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13603
x-xss-protection: 0
server: cafe
etag: 10298091897263888815
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Tue, 10 Sep 2024 12:28:50 GMT

POST
H2 200 xtra.gif
g.ezoic.net/detroitchicago/ 43 B
124 B 8ms
7ms Ping
image/gif 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/xtra.gif
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: br
access-control-max-age: 1728000
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
access-control-allow-headers: Content-Type
content-length: 47
expires: Mon, 11 Sep 2023 07:21:10 GMT

POST
H2 200 xtra.gif
g.ezoic.net/detroitchicago/ 43 B
78 B 8ms
7ms Ping
image/gif 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/xtra.gif
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: br
access-control-max-age: 1728000
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
access-control-allow-headers: Content-Type
content-length: 47
expires: Mon, 11 Sep 2023 07:21:10 GMT

POST
H2 200 xtra.gif
g.ezoic.net/detroitchicago/ 43 B
78 B 9ms
6ms Ping
image/gif 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/xtra.gif
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: br
access-control-max-age: 1728000
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
access-control-allow-headers: Content-Type
content-length: 47
expires: Mon, 11 Sep 2023 07:21:10 GMT

POST
H2 200 xtra.gif
g.ezoic.net/detroitchicago/ 43 B
78 B 8ms
7ms Ping
image/gif 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/xtra.gif
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: br
access-control-max-age: 1728000
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
access-control-allow-headers: Content-Type
content-length: 47
expires: Mon, 11 Sep 2023 07:21:10 GMT

POST
H2 200 xtra.gif
g.ezoic.net/detroitchicago/ 43 B
78 B 8ms
7ms Ping
image/gif 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/xtra.gif
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: br
access-control-max-age: 1728000
access-control-allow-methods: HEAD, PUT, POST, GET, OPTIONS
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
access-control-allow-headers: Content-Type
content-length: 47
expires: Mon, 11 Sep 2023 07:21:10 GMT

GET
H2 200 container.html Show response
28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 19B0 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://rorleggertroms.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Sep 2023 07:21:09 GMT
expires: Wed, 11 Sep 2024 07:21:09 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 greenoaks.gif
g.ezoic.net/detroitchicago/ 0
16 B 7ms
6ms Ping
text/plain 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiJkZDY5MGMzMC0yM2Q0LTQwN2YtNDQ4MC05Njg1NDI5ODRjZTciLCJkb21haW5faWQiOiI0NjYxMDciLCJ0X2Vwb2NoIjoxNjk0NTAzMjY4LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjIxNjAifV19XQ==&visit_uuid=NaN
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: ezp_sol
date: Tue, 12 Sep 2023 07:21:10 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Mon, 11 Sep 2023 07:21:10 GMT

POST
H2 204 army.gif
g.ezoic.net/porpoiseant/ 0
16 B 7ms
7ms Ping
text/plain 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc4OTAzODY2MDIzMDQxMSIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInVuaXQiOiJyb3JsZWdnZXJ0cm9tc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI2Nzg5MDM4NjYwMjMwNDExIiwiZG9tYWluX2lkIjoiNDY2MTA3IiwidW5pdCI6InJvcmxlZ2dlcnRyb21zX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjk0NTAzMjY4LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiJkZDY5MGMzMC0yM2Q0LTQwN2YtNDQ4MC05Njg1NDI5ODRjZTciLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiMzUzMGZjYjZiY2MxM2RjM2MxNzEyZWFlZjdkOTI3MDAifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjY3ODkwMzg2NjAyMzA0MTEiLCJkb21haW5faWQiOiI0NjYxMDciLCJ1bml0Ijoicm9ybGVnZ2VydHJvbXNfY29tLXBpeGVsMSIsInRfZXBvY2giOjE2OTQ1MDMyNjgsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMTYsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDE2LCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjY3ODkwMzg2NjAyMzA0MTEiLCJkb21haW5faWQiOiI0NjYxMDciLCJ1bml0Ijoicm9ybGVnZ2VydHJvbXNfY29tLXBpeGVsMSIsInRfZXBvY2giOjE2OTQ1MDMyNjgsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6ImRkNjkwYzMwLTIzZDQtNDA3Zi00NDgwLTk2ODU0Mjk4NGNlNyIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDAzNDU4NSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc4OTAzODY2MDIzMDQxMSIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInVuaXQiOiJyb3JsZWdnZXJ0cm9tc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=&visit_uuid=a6808c52-52cc-42fc-7467-43d06045e1ff
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: ezp_sol
date: Tue, 12 Sep 2023 07:21:10 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Mon, 11 Sep 2023 07:21:10 GMT

POST
H2 204 army.gif
g.ezoic.net/porpoiseant/ 0
16 B 6ms
6ms Ping
text/plain 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc4OTAzODY2MDIzMDQxMSIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInVuaXQiOiJyb3JsZWdnZXJ0cm9tc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMDktMTIifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiI5In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==&visit_uuid=a6808c52-52cc-42fc-7467-43d06045e1ff
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: ezp_sol
date: Tue, 12 Sep 2023 07:21:10 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Mon, 11 Sep 2023 07:21:10 GMT

POST
H2 204 army.gif
g.ezoic.net/porpoiseant/ 0
16 B 6ms
6ms Ping
text/plain 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNjc4OTAzODY2MDIzMDQxMSIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInVuaXQiOiJyb3JsZWdnZXJ0cm9tc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiYXVjdGlvbl9lcG9jaCI6MTY5NDUwMzI3MSwiYWRfcG9zaXRpb24iOjk5OTksImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiJkZDY5MGMzMC0yM2Q0LTQwN2YtNDQ4MC05Njg1NDI5ODRjZTciLCJiaWRfZmxvb3JfaW5pdGlhbCI6MTYwLCJiaWRfZmxvb3JfcHJldiI6bnVsbCwiYmlkX2Zsb29yX2ZpbGxlZCI6MTYwLCJhdWN0aW9uX2NvdW50IjoxLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo3OTcsIm11bHRpX2FkX3VuaXQiOm51bGwsIm11bHRpX2FkX2NvdW50IjpudWxsLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: ezp_sol
date: Tue, 12 Sep 2023 07:21:10 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Mon, 11 Sep 2023 07:21:10 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 19B0 4 KB
767 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 06:18:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Sep 2023 07:21:10 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame B4E3 14 KB
1 KB 15ms
15ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 12 Sep 2023 06:18:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Sep 2023 07:21:10 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230907/r20110914/client/ Frame B4E3 2 KB
945 B 58ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230907/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 17:36:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49487
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 17:36:23 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230907/r20110914/ Frame B4E3 23 KB
9 KB 58ms
11ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230907/r20110914/abg_lite_fy2021.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 17:36:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49487
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9135
x-xss-protection: 0
server: cafe
etag: 9583221549990841032
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 17:36:23 GMT

GET
H2 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 47CB 143 B
383 B 26ms
6ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3447
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Sep 2023 06:23:43 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230907/r20110914/client/ Frame B4E3 3 KB
1 KB 59ms
13ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230907/r20110914/client/window_focus_fy2021.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 20:45:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38168
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 20:45:02 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 220F 1 KB
1001 B 30ms
8ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 72431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Sep 2023 11:13:59 GMT
etag: 48472445140208031
expires: Tue, 12 Sep 2023 11:13:59 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230907/r20110914/client/ Frame B4E3 20 KB
8 KB 52ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230907/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 17:36:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 49487
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8275
x-xss-protection: 0
server: cafe
etag: 7349537481621356269
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 17:36:23 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame B4E3 0
0 37ms
14ms Image
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQExRvDwiXZ8inBiRFYIaz8Z8lFYxeArq4__B92zzK2rmUyn6wvVxMKsSmzwjvNW6ofv9uSZAe8zyl5KnFKgRM9tZvg4Q
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B4E3 181 KB
57 KB 68ms
44ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c620084286d4e8ac0ebd4811a782920ac935265c8cdbf0010ea7243bd81a6e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57841
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1694001950986259"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Sep 2023 07:21:10 GMT

GET
H2 200 1c0c92110fea9bdf1302b7cf16d857ac.js Show response
www.gstatic.com/mysidia/ Frame B4E3 36 KB
15 KB 28ms
6ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1c0c92110fea9bdf1302b7cf16d857ac.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

143d681dc8ed67d5acf692ab8bd8f25a87b411bad534980984107887c6f82af2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 11:05:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72915
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15112
x-xss-protection: 0
last-modified: Wed, 06 Sep 2023 19:29:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 10 Dec 2023 11:05:55 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230907/r20110914/elements/html/ Frame 19B0 20 KB
8 KB 48ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230907/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd91080d2c7f2120ad82727f5c07bbb439b810ed4035993ddb1825ca1611396b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 18:38:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45785
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8566
x-xss-protection: 0
server: cafe
etag: 5625731030761120726
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 25 Sep 2023 18:38:05 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 19B0 205 B
296 B 24ms
8ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Sun, 10 Sep 2023 13:30:10 GMT
x-content-type-options: nosniff
age: 150660
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 09 Sep 2024 13:30:10 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 19B0 604 B
920 B 24ms
7ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Wed, 06 Sep 2023 21:04:39 GMT
x-content-type-options: nosniff
age: 468991
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 05 Sep 2024 21:04:39 GMT

GET
H2

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 47CB
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
298 B

17ms
16ms

Document
text/html

2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Sep 2023 07:21:10 GMT
expires: Tue, 12 Sep 2023 07:21:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Sep 2023 07:21:10 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 220F
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEE7OhJW-va18aIMdAQAtwzI&google_cver=1&google_push=AXcoOmSSu5bGc68EPbU49jQph2xXFgrXMdSsGvuTZrCgdyMsYeYNq9WJwonI2_TwR7DG6c7OqTDZlsbTpSpUkpmu2SCjnc-4ePxpdg
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDMyMTcwNTM0MzEzMDY1NTQyMw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEE7OhJW-va18aIMdAQAtwzI&google_cver=1

43 B
398 B

66ms
25ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEE7OhJW-va18aIMdAQAtwzI&google_cver=1
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEE7OhJW-va18aIMdAQAtwzI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 220F
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESECnRTN9_jCXdnHFH36tgjII&google_cver=1&google_push=AXcoOmS3cSVVYf6lof5EiwSyfH7BTR-z3rgZ5dnDnVRx_qb5C-AC-MwaXUULH5LVys1vFnDnEM-V-lejMrZlGT83a7v7sQX-N4L7nA
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=911C119B35784528879974C49D838949&google_push=AXcoOmS3cSVVYf6lof5EiwSyfH7BTR-z3rgZ5dnDnVRx_qb5C-AC-MwaXUULH5LVys1vFnDnEM-V-lejMrZlGT8...

170 B
232 B

18ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=911C119B35784528879974C49D838949&google_push=AXcoOmS3cSVVYf6lof5EiwSyfH7BTR-z3rgZ5dnDnVRx_qb5C-AC-MwaXUULH5LVys1vFnDnEM-V-lejMrZlGT83a7v7sQX-N4L7nA

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Sep 2023 07:21:10 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=911C119B35784528879974C49D838949&google_push=AXcoOmS3cSVVYf6lof5EiwSyfH7BTR-z3rgZ5dnDnVRx_qb5C-AC-MwaXUULH5LVys1vFnDnEM-V-lejMrZlGT83a7v7sQX-N4L7nA
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 11 Sep 2023 07:21:10 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 220F
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESELRv54frFrIcuI81SsGRx8A&google_cver=1&google_push=AXcoOmSo37qsxYagiwF8DSkTTlJzA2LfJ8kK1NmIMY3GCnieZq2f5KxIHx5TxUQXJa0nY3-j3H0CNA7Xd5q...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSo37qsxYagiwF8DSkTTlJzA2LfJ8kK1NmIMY3GCnieZq2f5KxIHx5TxUQXJa0nY3-j3H0CNA7Xd5qHbH3uHOYLuxCCk2q_yw&google_hm=nB4fmilATsWknSXU22...

170 B
329 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSo37qsxYagiwF8DSkTTlJzA2LfJ8kK1NmIMY3GCnieZq2f5KxIHx5TxUQXJa0nY3-j3H0CNA7Xd5qHbH3uHOYLuxCCk2q_yw&google_hm=nB4fmilATsWknSXU22GKNkw

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmSo37qsxYagiwF8DSkTTlJzA2LfJ8kK1NmIMY3GCnieZq2f5KxIHx5TxUQXJa0nY3-j3H0CNA7Xd5qHbH3uHOYLuxCCk2q_yw&google_hm=nB4fmilATsWknSXU22GKNkw
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 220F
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEJ6F8lB9xCC0DptTivWD6yo&google_cver=1&google_push=AXcoOmTTbRhoHZE9dfORLwTFA6JnnU66aLhdNE_ZJ2ujLcgFjF1eVn7-adFHG5xndIEdxNVQ6BPhliBpHtVJqWWc...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=zXqDAeSCS7OkZRSpLMDIxw2&google_push=AXcoOmTTbRhoHZE9dfORLwTFA6JnnU66aLhdNE_ZJ2ujLcgFjF1eVn7-adFHG5xndIEdxNVQ6BPhliBpHtVJqWWcT-JR-ycjt-z-AA

170 B
232 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=zXqDAeSCS7OkZRSpLMDIxw2&google_push=AXcoOmTTbRhoHZE9dfORLwTFA6JnnU66aLhdNE_ZJ2ujLcgFjF1eVn7-adFHG5xndIEdxNVQ6BPhliBpHtVJqWWcT-JR-ycjt-z-AA

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Sep 2023 07:21:10 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=zXqDAeSCS7OkZRSpLMDIxw2&google_push=AXcoOmTTbRhoHZE9dfORLwTFA6JnnU66aLhdNE_ZJ2ujLcgFjF1eVn7-adFHG5xndIEdxNVQ6BPhliBpHtVJqWWcT-JR-ycjt-z-AA
x-host: tde-deliveryengine-production-5c7796b7ff-27x2f
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 220F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=KVAxq7BbQQS1kWR_veVfQg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=KVAxq7BbQQS1kWR_veVfQg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmSRSiCEWfamhs4OuXOooV6UMKqde3WK1m0NFbANMV0TsApw29YI3khdNeysefdsQ4sKdP3bjVGYDhcmHYUtB48dXsM7Ku9b7g

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=KVAxq7BbQQS1kWR_veVfQg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AXcoOmSRSiCEWfamhs4OuXOooV6UMKqde3WK1m0NFbANMV0TsApw29YI3khdNeysefdsQ4sKdP3bjVGYDhcmHYUtB48dXsM7Ku9b7g
date: Tue, 12 Sep 2023 07:21:10 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 220F
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKkuNJA4s5XBpbCMnYxDG1U&google_cver=1&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjk...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEKkuNJA4s5XBpbCMnYxDG1U&google_cver=1&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjk...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjkts8Hox23Qc0sw&google_hm=HTr5qGZHXsZODGhPQtye...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjkts8Hox23Qc0sw&google_hm=HTr5qGZHXsZODGhPQtyekwYs

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 12 Sep 2023 07:21:10 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AXcoOmTwAz5cU0lCIqXHTBBTX-YZcT4qti1v7P8KqayJST04aTXvOf5-sJ6eKyo3mmK6UjO-IWajhZYka0Lf6_bjkts8Hox23Qc0sw&google_hm=HTr5qGZHXsZODGhPQtyekwYs
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1

200

0.gif
id5-sync.com/i/495/ Frame 220F
Redirect Chain

https://sync.inmobi.com/gob?google_gid=CAESEAnXTzsvzCPi9RaaCcntNSQ&google_cver=1&google_push=AXcoOmS1So1sLjoqqPRulxmno6CE6friCG6DzMsUGlaZZ1zCsIpXT8SQZwy87pdMvtjuV7vI3VAqwn7lbypF2IhzQOzXZi516dXypg
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmS1So1sLjoqqPRulxmno6CE6friCG6DzMsUGlaZZ1zC...

43 B
1 KB

20ms
7ms

Image
image/gif

162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmS1So1sLjoqqPRulxmno6CE6friCG6DzMsUGlaZZ1zCsIpXT8SQZwy87pdMvtjuV7vI3VAqwn7lbypF2IhzQOzXZi516dXypg

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

HTTP/1.1

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

content-type: image/gif;charset=UTF-8
date: Tue, 12 Sep 2023 07:21:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding: chunked
p3p: CP="CAO PSA OUR"

Redirect headers

date: Tue, 12 Sep 2023 07:21:11 GMT
content-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options: nosniff
strict-transport-security: max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer
expect-ct: max-age=0
x-dns-prefetch-control: off
x-frame-options: SAMEORIGIN
content-type: text/plain; charset=utf-8
location: https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DAXcoOmS1So1sLjoqqPRulxmno6CE6friCG6DzMsUGlaZZ1zCsIpXT8SQZwy87pdMvtjuV7vI3VAqwn7lbypF2IhzQOzXZi516dXypg
x-download-options: noopen
vary: Accept
content-length: 273
x-xss-protection: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 220F 0
130 B 46ms
16ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LYQ49XKz4jn35GU067UgYlpy3ZfVvojJCFE1SjDxvs_JfpdiAPJJXsPb54xw5Aqh6r1MFf9Q

Requested by

Host: 28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
URL: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:10 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 YBinSErTekvxupjb6vinQNaPBzh8KEiIox6QinbqyX4.js Show response
pagead2.googlesyndication.com/bg/ Frame C40A 37 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/YBinSErTekvxupjb6vinQNaPBzh8KEiIox6QinbqyX4.js

Requested by

Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6018a7484ad37a4bf1ba98dbeaf8a740d68f07387c284888a31e908a76eac97e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Mon, 11 Sep 2023 09:26:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 78902
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14735
x-xss-protection: 0
last-modified: Mon, 04 Sep 2023 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 10 Sep 2024 09:26:08 GMT

POST
H2 200 92577418 Show response
mc.yandex.com/webvisor/ 43 B
145 B 343ms
113ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/92577418?wv-part=1&wmode=0&wv-hit=470218800&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rn=477953403&wv-type=3&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1694503271%3Aw%3A1600x1200%3Av%3A1111%3Az%3A120%3Ai%3A20230912092111%3Au%3A1694503269437627901%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Ast%3A1694503271&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:11 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 12-Sep-2023 07:21:11 GMT
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:11 GMT

GET envelope
lexicon.33across.com/v1/ 0
0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
173 B 575ms
574ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2959739806102819&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=7&didk=2366700391&sfv=1-0-40&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503271466&lmt=1685923976&adxs=1440&adys=304&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D4224405130217051%26eid%3D4224405130217051%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Drorleggertroms_com-edge-2-4224405130217051%26eb_br%3D58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26bv%3D0%26bvm%3D5%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747&adks=3263339177&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63990db6fd26af36e8efc59cdbabb74c7fb458eea166ecb9f4610a394fa7cbd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gilamonster.js Show response
rorleggertroms.com/beardeddragon/ 88 KB
19 KB 1045ms
1045ms Script
application/javascript 81.177.135.102
RTCOMM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://rorleggertroms.com/beardeddragon/gilamonster.js?cb=184
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 81.177.135.102 , Russian Federation, ASN8342 (RTCOMM-AS, RU),
Reverse DNS: srv146-h-st.jino.ru
Software: Jino.ru/mod_pizza /
Resource Hash: 89ae86da736ac0efd37793e8120cfeb66df971ef27b5b91b92dcb507c0b475f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: gzip
server: Jino.ru/mod_pizza
http_code: HTTP/2 200
vary: Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: no-cache, must-revalidate, max-age=0, max-age=31536000, public
x-robots-tag: noindex
content-length: 19544
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 si
capi.connatix.com/tr/ 0
311 B 173ms
135ms Image
application/json 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/tr/si?token=dceed97a-951e-4c47-b565-c2794ffae817&cid=5f049401-746e-4449-8c27-b6b9d8e25882
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 80566469e924bb97-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/333934/ Frame D0ED
Redirect Chain

https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
https://cds.connatix.com/p/333934/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882&tier=1

1 MB
295 KB

60ms
34ms

Script
application/javascript

104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/333934/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882&tier=1
Requested by: Host: rorleggertroms.com
URL: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
Protocol: H2
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90da7c0b62fa01374005e68b4ca68df96df83d1b1d855e4548e8492cfd820de3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
x-amz-version-id: Cm0c2O5k6e1i0Vn0RpAovRZJ98mUfONV
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 11 Sep 2023 10:16:10 GMT
server: cloudflare
etag: W/"8e753f611febf6520eec23b378b54f94"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 8056646aed3330fa-FRA
access-control-allow-headers: range
expires: Wed, 11 Sep 2024 07:21:12 GMT

Redirect headers

date: Tue, 12 Sep 2023 07:21:12 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
location: https://cds.connatix.com/p/333934/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882&tier=1
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 80566469ec0230fa-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

POST
H2 200 92577418 Show response
mc.yandex.com/webvisor/ 43 B
145 B 118ms
117ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/92577418?wv-part=2&wmode=0&wv-hit=470218800&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rn=828608074&wv-type=3&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1694503272%3Aw%3A1600x1200%3Av%3A1111%3Az%3A120%3Ai%3A20230912092112%3Au%3A1694503269437627901%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Ast%3A1694503272&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:12 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 12-Sep-2023 07:21:12 GMT
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:12 GMT

GET

sync
capi.connatix.com/core/ Frame D0ED
Redirect Chain

https://capi.connatix.com/core/sync?v=333934
https://capi.connatix.com/core/sync?v=333934&tier=1&final=true&ImplementationType=0

0
0

POST
H2 200 ucl Show response
capi.connatix.com/tr/ Frame D0ED 0
99 B 127ms
126ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ucl?v=333934
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8056646bbb44bb97-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

POST
H2 200 pls Show response
capi.connatix.com/core/ Frame D0ED 30 KB
7 KB 173ms
172ms XHR
application/x-protobuf 172.64.146.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=333934&cid=5f049401-746e-4449-8c27-b6b9d8e25882
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.146.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b69d470ee7498e7b16f77302c5071a479877fcbb53c0b7d714983162ce0826c

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 8056646bbb4abb97-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

GET
H2 200 hls.1.3.4.js Show response
cds.connatix.com/a/ 263 KB
78 KB 39ms
38ms Script
application/javascript 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/a/hls.1.3.4.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: acff18b9dd469f70f4d45d24dadf6de847a9b3abeb3e891260eb8160ffac8039

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
x-amz-version-id: 08mQY6.qD2K9uG9Q090ZpTuzVoe6eKbG
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 May 2023 13:03:31 GMT
server: cloudflare
etag: W/"2065fde20cf0becb2eb29a9fa8b9936f"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 8056646bbe4630fa-FRA
access-control-allow-headers: range
expires: Wed, 11 Sep 2024 07:21:12 GMT

GET
H2 200 player.css
cds.connatix.com/p/333934/ 68 KB
12 KB 23ms
23ms Stylesheet
text/css 104.18.41.104
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/333934/player.css
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.41.104 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 18f41a5cdab97125db80a2b6fd5dd8da8fc63a42736d9867b769e5fe58a9931e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
x-amz-version-id: iZRWu3lIJbdlGJWriP_3gYKiObdvcIb3
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 11 Sep 2023 10:16:10 GMT
server: cloudflare
etag: W/"7b624eb55c0d06f78a24178f3f2e0d12"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 8056646bce4a30fa-FRA
access-control-allow-headers: range
expires: Wed, 11 Sep 2024 07:21:12 GMT

POST
H2 200 92577418 Show response
mc.yandex.com/webvisor/ 43 B
73 B 61ms
61ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/92577418?wv-part=1&wmode=0&wv-hit=470218800&page-url=https%3A%2F%2Frorleggertroms.com%2Fhva-skjer-om-man-betaler-husleie-for-sent%2F&rn=537149722&wv-type=3&browser-info=we%3A1%3Aet%3A1694503272%3Aw%3A1600x1200%3Av%3A1111%3Az%3A120%3Ai%3A20230912092112%3Au%3A1694503269437627901%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Ast%3A1694503272&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://rorleggertroms.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:12 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 12-Sep-2023 07:21:12 GMT
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:12 GMT

POST
H2 204 army.gif
g.ezoic.net/porpoiseant/ 0
62 B 7ms
6ms Ping
text/plain 2a05:d014:776:a63d:6339:2a28:fc90:eea
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc4OTAzODY2MDIzMDQxMSIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInVuaXQiOiJyb3JsZWdnZXJ0cm9tc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MDAsMTIwMF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjY3ODkwMzg2NjAyMzA0MTEiLCJkb21haW5faWQiOiI0NjYxMDciLCJ1bml0Ijoicm9ybGVnZ2VydHJvbXNfY29tLXBpeGVsMSIsInRfZXBvY2giOjE2OTQ1MDMyNjgsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6ImRkNjkwYzMwLTIzZDQtNDA3Zi00NDgwLTk2ODU0Mjk4NGNlNyIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc4OTAzODY2MDIzMDQxMSIsImRvbWFpbl9pZCI6IjQ2NjEwNyIsInVuaXQiOiJyb3JsZWdnZXJ0cm9tc19jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY5NDUwMzI2OCwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiZGQ2OTBjMzAtMjNkNC00MDdmLTQ0ODAtOTY4NTQyOTg0Y2U3IiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiJ1bmRlZmluZWQifV0sImlzX29yaWciOmZhbHNlfV0=&visit_uuid=a6808c52-52cc-42fc-7467-43d06045e1ff
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/parsonsmaize/abilene.js?gcb=195-7&cb=28
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63d:6339:2a28:fc90:eea Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://rorleggertroms.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

access-control-allow-origin: https://rorleggertroms.com
x-middleton-display: ezp_sol
date: Tue, 12 Sep 2023 07:21:12 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Mon, 11 Sep 2023 07:21:12 GMT

GET 1_media.bin
vid.connatix.com/pid-dceed97a-951e-4c47-b565-c2794ffae817/f2590cdd-0bb5-401c-a109-f286e7a52d32/ Frame D0ED 0
0

GET blockedDomains_1.bin
lit.connatix.com/bc0fdb4c-d321-4f31-b048-7f8fbe727deb/ Frame D0ED 0
0

POST ucl
capi.connatix.com/tr/ Frame D0ED 0
0

GET ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame D0ED 0
0

GET elements.ui.a549d09b26e367bbc8b9.js
cds.connatix.com/p/333934/ Frame D0ED 0
0

POST iev
csm.nl3.eu.criteo.net/ Frame 54A8 0
0

GET
H2 200 26302566
mc.yandex.com/watch/ 43 B
72 B 58ms
58ms Image
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/watch/26302566?browser-info=ar%3A1%3Apv%3A1%3Av%3A1111%3Avf%3A3qm6qq812ez2u52y4wzrnbv&page-url=about%3Ablank&site-info=%7B%22jserrs%22%3A%7B%221111%22%3A%7B%22Cannot%20read%20properties%20of%20null%20(reading%20%27contains%27)%22%3A%7B%22wv2.c.mu.r%22%3A%7B%22about%3Ablank%22%3A%22TypeError%3A%20Cannot%20read%20properties%20of%20null%20(reading%20%27contains%27)%5C%5Cn%20%20%20%20at%20Ai%20(https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A80%3A52)%5C%5Cn%20%20%20%20at%20https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A297%3A112%5C%5Cn%20%20%20%20at%20Array.map%20(%3Canonymous%3E)%5C%5Cn%20%20%20%20at%20C%20(https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A179%3A503)%5C%5Cn%20%20%20%20at%20c.Yd%20(https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A297%3A76)%5C%5Cn%20%20%20%20at%20c.Yd%20(https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A136%3A85)%5C%5Cn%20%20%20%20at%20https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A296%3A13%5C%5Cn%20%20%20%20at%20Array.map%20(%3Canonymous%3E)%5C%5Cn%20%20%20%20at%20C%20(https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A179%3A503)%5C%5Cn%20%20%20%20at%20c.Pd%20(https%3A%2F%2Fmc.yandex.ru%2Fmetrika%2Ftag.js%3A295%3A429)%22%7D%7D%7D%7D%7D

Requested by

Host: blank
URL: about:blank

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:12 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 12-Sep-2023 07:21:12 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:12 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
173 B 345ms
345ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2243667353391916&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=8&didk=2366700391&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503272568&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D4224405130217051%26eid%3D4224405130217051%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Drorleggertroms_com-edge-2-4224405130217051%26eb_br%3Dccfa51bd57bf7c8733d23a1a2233a455%2Cc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26bv%3D0%26bvm%3D5%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%26lb%3D120%26reqt%3D1694503272565&adks=3263339177&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c3b3856e14e07c6c2fa145b102a3b3a2d61838e0d1a9ce47e9605e5f9a9df820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
173 B 293ms
293ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1155324750757451&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=9&didk=2366647195&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503272573&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2430424402217963%26eid%3D2430424402217963%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Drorleggertroms_com-edge-1-2430424402217963%26eb_br%3D9e53bab967879f5f4e47bf92bc6a1913%2Ca495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26bv%3D25%26bvm%3D1%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D100%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%26lb%3D120%26reqt%3D1694503272570&adks=2503113591&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

122daa1988003bd8d7ee5194b8d1da72599efc7e1550d7a369cbafb3e009d9bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 356ms
356ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2065891856736974&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=10&didk=3996782115&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503272577&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3D9e53bab967879f5f4e47bf92bc6a1913%2Ca495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D100%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%26lb%3D120%26reqt%3D1694503272575&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3050049fe1aafe04c75e6255bc2009b096783a8a67973ed77e60288a5a573bfc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 389 B
171 B 310ms
310ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1285912520019401&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=11&didk=3995623278&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503272581&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5176630652180546%26eid%3D5176630652180546%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Drorleggertroms_com-box-1-5176630652180546%26eb_br%3D8f06634228a09c75917ea2bd02ad38f7%2C58ef7bddb438af5e257c4377f32c243a%26eba%3D1%26bv%3D30%26bvm%3D3%26bvr%3D4%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D120%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%26lb%3D120%26reqt%3D1694503272579&adks=3322963612&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

68947fac6fcccadf74e402aa5be850be56edeb80b1614dbd8f26a8b2eb59c978

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 397 B
179 B 351ms
351ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1820496515295969&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=12&didk=2321484075&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503272584&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D1461121202219410%26eid%3D1461121202219410%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Drorleggertroms_com-medrectangle-2-1461121202219410%26eb_br%3Db1504f3a2a8ef43af1c415e0b69ffdea%2Cb355e9227b551c119a30a68852723b62%26eba%3D1%26bv%3D0%26bvm%3D4%26bvr%3D4%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%26lb%3D100%26reqt%3D1694503272582&adks=3250143347&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d581fdeaa9ddb4bdd3e34d86a525745a956368a81262030f4db346bad7ac91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 149
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 332ms
331ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2800831489612104&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=13&didk=3995605495&sfv=1-0-40&rcs=1&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503272587&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3Dccfa51bd57bf7c8733d23a1a2233a455%2Cc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%26lb%3D120%26reqt%3D1694503272585&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e8acce91547c5ac5db6803dbd75cf9f477d37fb340baaed261a7ebddfe68550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:12 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 92577418 Show response
mc.yandex.com/webvisor/ 43 B
145 B 121ms
120ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/webvisor/92577418?wv-part=3&wmode=0&wv-hit=470218800&page-url=about%3Ablank&rn=788586623&wv-type=3&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1694503274%3Aw%3A1600x1200%3Av%3A1111%3Az%3A120%3Ai%3A20230912092114%3Au%3A1694503269437627901%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Ast%3A1694503274&t=gdpr(14)ti(2)

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:14 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 12-Sep-2023 07:21:14 GMT
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:14 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
172 B 341ms
341ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3182475027141004&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=14&didk=2366700391&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274081&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D4224405130217051%26eid%3D4224405130217051%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Drorleggertroms_com-edge-2-4224405130217051%26eb_br%3D35493b6c609bcc54ab5f042306e6f96f%2Ca7a863b24978e69c4cdbb5a49be70d5e%26eba%3D1%26bv%3D0%26bvm%3D5%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D34%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%26lb%3D60%26reqt%3D1694503273072&adks=3263339177&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

693a447f04a2b4257d52eb5ffee55fb86c5d03a2831f7ba1a1f1f50f3d25a89b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 142
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
172 B 270ms
270ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1698100692172193&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=15&didk=2366647195&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274088&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2430424402217963%26eid%3D2430424402217963%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Drorleggertroms_com-edge-1-2430424402217963%26eb_br%3Db1504f3a2a8ef43af1c415e0b69ffdea%2Cb355e9227b551c119a30a68852723b62%26eba%3D1%26bv%3D25%26bvm%3D1%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%26lb%3D100%26reqt%3D1694503273082&adks=2503113591&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1742919edfb903be6f155c6f76137821d153521e7b3d38ca50403f10395e4932

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 142
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
168 B 385ms
384ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3451281134446058&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=16&didk=3996782115&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274105&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3Db1504f3a2a8ef43af1c415e0b69ffdea%2Cb355e9227b551c119a30a68852723b62%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D90%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%26lb%3D100%26reqt%3D1694503273098&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d967ecbb7a58c5201803ef09bd673c7eeaff8f940c77e81ed58fa2bb34c6910

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 389 B
170 B 255ms
255ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=95882263095585&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=17&didk=3995623278&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274108&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5176630652180546%26eid%3D5176630652180546%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Drorleggertroms_com-box-1-5176630652180546%26eb_br%3Db1504f3a2a8ef43af1c415e0b69ffdea%2Cb355e9227b551c119a30a68852723b62%26eba%3D1%26bv%3D30%26bvm%3D3%26bvr%3D4%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D90%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%26lb%3D120%26reqt%3D1694503273099&adks=3322963612&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7b7c37ff19dc805c5f20c4d2e50383fb1311f84f9fb72e73156398cb92e8e670

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 397 B
179 B 254ms
254ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3645059317493690&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=18&didk=2321484075&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274112&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D1461121202219410%26eid%3D1461121202219410%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Drorleggertroms_com-medrectangle-2-1461121202219410%26eb_br%3D2045167b6b8fb0fb31ddc0b75e5fad33%2Cdfa60cee6e1053fc0c9e607c8047bd28%26eba%3D1%26bv%3D0%26bvm%3D4%26bvr%3D4%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D80%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%26lb%3D90%26reqt%3D1694503273099&adks=3250143347&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b0ca07b422694aa63db31ba42e9dbddedeca043abc32c01c94c9231089c5d94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 149
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 537ms
536ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2497423775039128&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=19&didk=3995605495&sfv=1-0-40&rcs=2&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274116&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3D6903f7bbc0b378e6ce4f01bb6b8387a0%2C947f1d5169cc7d0f997560e34838fb04%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D42%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%26lb%3D60%26reqt%3D1694503273099&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31782d9c0e8ae896d02c4cbd7a4a30114dd9c33a03f62cb5a8cf27d0755c3ce4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
172 B 351ms
351ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=949028316780595&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=20&didk=2366700391&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274587&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D4224405130217051%26eid%3D4224405130217051%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Drorleggertroms_com-edge-2-4224405130217051%26eb_br%3Dee6dd80c4affd9867ab8ed29855e48c6%2Cad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26bv%3D0%26bvm%3D5%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D14%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D34%26reqt%3D1694503274584&adks=3263339177&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cfff8b14f553bbfdb463cf5bdf9b198751acfd5b106dfb0bdecddd239b9a57df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 142
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
173 B 272ms
271ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2164215366619650&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=21&didk=2366647195&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274601&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2430424402217963%26eid%3D2430424402217963%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Drorleggertroms_com-edge-1-2430424402217963%26eb_br%3D2045167b6b8fb0fb31ddc0b75e5fad33%2Cdfa60cee6e1053fc0c9e607c8047bd28%26eba%3D1%26bv%3D25%26bvm%3D1%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D80%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%26lb%3D90%26reqt%3D1694503274598&adks=2503113591&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5710946801913330246ddf82b742fae8d61f18cf6ad1df8d66237fe2f2b5979a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 276ms
275ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1951043287151137&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=22&didk=3996782115&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274617&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3D2045167b6b8fb0fb31ddc0b75e5fad33%2Cdfa60cee6e1053fc0c9e607c8047bd28%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D80%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%26lb%3D90%26reqt%3D1694503274615&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b7e9a360e5833452f3b45ad216bff5126a8ac6554521f80a409e9e5a9c477f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 389 B
171 B 244ms
244ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1814839851780767&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=23&didk=3995623278&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274622&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5176630652180546%26eid%3D5176630652180546%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Drorleggertroms_com-box-1-5176630652180546%26eb_br%3Db1504f3a2a8ef43af1c415e0b69ffdea%2Cb355e9227b551c119a30a68852723b62%26eba%3D1%26bv%3D30%26bvm%3D3%26bvr%3D4%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D90%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%26lb%3D90%26reqt%3D1694503274619&adks=3322963612&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

94e88086c317722fbcd16cf8c1a012d6c267e8d0d48d75365e0e0ecc54d3f23d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 397 B
181 B 356ms
356ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3680358423877911&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=24&didk=2321484075&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274628&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D1461121202219410%26eid%3D1461121202219410%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Drorleggertroms_com-medrectangle-2-1461121202219410%26eb_br%3De258137a22d8fe33e70a7d872dee5b3a%2Cd31e71883d00099e275b6c5878eed023%26eba%3D1%26bv%3D0%26bvm%3D4%26bvr%3D4%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D32%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%26lb%3D80%26reqt%3D1694503274623&adks=3250143347&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb9ffcf770a31935ababb185f0c03b1e0db98f0ebe3676811cc9974b60915db8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 151
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
168 B 303ms
302ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2220294724002517&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=25&didk=3995605495&sfv=1-0-40&rcs=3&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503274667&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3D57eefa0e7aa1cea09532fb6be35da4a3%2Cbf9a045b836005b6c23b7b0749249612%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D26%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%26lb%3D42%26reqt%3D1694503274665&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

099c8004b30c3cd38d096423267aab0133016168aaca63b761512abb03ccf1ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:14 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
174 B 255ms
255ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1506184874893913&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=26&didk=2366700391&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276094&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D4224405130217051%26eid%3D4224405130217051%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Drorleggertroms_com-edge-2-4224405130217051%26eb_br%3Dd88c48b8187682080255e7bb86b5627d%2C9c3e4ee8eae7f1433cb2fe69b1326605%26eba%3D1%26bv%3D0%26bvm%3D5%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D4%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D14%26reqt%3D1694503275089&adks=3263339177&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6aae437e88be47dcbffabaec463f1e45f7708e8be9a90033fa193997268e0250

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 144
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
172 B 308ms
308ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=4303955026246533&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=27&didk=2366647195&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276110&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2430424402217963%26eid%3D2430424402217963%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Drorleggertroms_com-edge-1-2430424402217963%26eb_br%3D2c1fa87e8d863c5c375068c7340eb8e6%2C527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26bv%3D25%26bvm%3D1%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%26lb%3D80%26reqt%3D1694503275105&adks=2503113591&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b0b88b72c10ea094d63919ed25cf812109949773de6a76200683d601434ae29b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 142
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
168 B 334ms
333ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1098375943063539&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=28&didk=3996782115&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276127&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3D2c1fa87e8d863c5c375068c7340eb8e6%2C527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D70%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%26lb%3D80%26reqt%3D1694503275122&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

85f98afdba8e7e98067f5198df27eb6a7b600ef4bb0486be0fe49ffbb326d0d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 389 B
170 B 265ms
265ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=213749128360967&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=29&didk=3995623278&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276137&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5176630652180546%26eid%3D5176630652180546%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Drorleggertroms_com-box-1-5176630652180546%26eb_br%3D2c1fa87e8d863c5c375068c7340eb8e6%2C527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26bv%3D30%26bvm%3D3%26bvr%3D4%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D70%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%26lb%3D90%26reqt%3D1694503275131&adks=3322963612&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5519b950758fc3d64927f789d8cfdeca7db5982201d8dbd02b181cdfac1281a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 397 B
180 B 249ms
249ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=4187533445969541&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=30&didk=2321484075&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276154&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D1461121202219410%26eid%3D1461121202219410%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Drorleggertroms_com-medrectangle-2-1461121202219410%26eb_br%3D798553aec6ae9c46c02bfab762f0e05a%2C7432360301409ae695ba255f16fbcf06%26eba%3D1%26bv%3D0%26bvm%3D4%26bvr%3D4%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D20%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3053%2C4276%26lb%3D32%26reqt%3D1694503275148&adks=3250143347&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dea7791f04f673748aa8e629f6475a0ee9e4b00de2f052605ae66084fee0e83a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 150
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
170 B 260ms
260ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=1362716718207176&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=31&didk=3995605495&sfv=1-0-40&rcs=4&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276174&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3Dee6dd80c4affd9867ab8ed29855e48c6%2Cad0061a38dd7c6f7bcb692aee88dfda4%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D14%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D26%26reqt%3D1694503275171&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fce30c16d4607902b83c82fed0bb71170f49b5a5be438a92275f395328fd973

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
173 B 380ms
380ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2240619215728248&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=32&didk=2366700391&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276601&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D4224405130217051%26eid%3D4224405130217051%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1102%26sap%3D1102%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D39%26al%3D1039%26compid%3D0%26tap%3Drorleggertroms_com-edge-2-4224405130217051%26eb_br%3Dzero%26eba%3D1%26bv%3D0%26bvm%3D5%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D4%26reqt%3D1694503276599%26ss38%3D1%26ss9%3D1&adks=3263339177&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca184070d27a37cac59eedfd1d9e69bc7fc7e28fce19b08b46094927aa60829f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
172 B 312ms
312ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=4436310951844475&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=33&didk=2366647195&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276618&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2430424402217963%26eid%3D2430424402217963%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Drorleggertroms_com-edge-1-2430424402217963%26eb_br%3Dccfa51bd57bf7c8733d23a1a2233a455%2Cc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26bv%3D25%26bvm%3D1%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%26lb%3D70%26reqt%3D1694503276616&adks=2503113591&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4449b5dace51af29ca51e5e14db2b91a091aa8fbc63c0cc99af22b439a3a2cae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 142
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 296ms
296ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3996968925382385&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=34&didk=3996782115&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276636&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3Dccfa51bd57bf7c8733d23a1a2233a455%2Cc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%26lb%3D70%26reqt%3D1694503276633&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

de99dafcc09ffe0a515adab9fe4f6cad240c65e882ef0d750406b381542d3f19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 389 B
171 B 312ms
312ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=383984115436832&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=336x280&ifi=35&didk=3995623278&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276654&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5176630652180546%26eid%3D5176630652180546%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1106%26sap%3D1106%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D0%26al%3D1000%26compid%3D0%26tap%3Drorleggertroms_com-box-1-5176630652180546%26eb_br%3Dzero%26eba%3D1%26bv%3D30%26bvm%3D3%26bvr%3D4%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D0%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D70%26reqt%3D1694503276648%26ss38%3D1%26ss9%3D1&adks=3322963612&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6363060dadef75c4795559051443181f3868f781beb33efeb93a10398d4acc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 397 B
179 B 341ms
341ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3147931493000860&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=36&didk=2321484075&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276667&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D1461121202219410%26eid%3D1461121202219410%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D6%26at%3Dbf%26adr%3D399%26ezosn%3D6%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Drorleggertroms_com-medrectangle-2-1461121202219410%26eb_br%3Dzero%26eba%3D1%26bv%3D0%26bvm%3D4%26bvr%3D4%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D20%26reqt%3D1694503276665%26ss38%3D1%26ss9%3D1&adks=3250143347&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8c1afb6d61df9ee5124b4cfecb321a77d9284d3cc45173c1843f25ff2ba33af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:16 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 149
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
168 B 330ms
330ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3401944133571917&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=37&didk=3995605495&sfv=1-0-40&rcs=5&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503276684&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D6%26at%3Dmbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3D399a91594aec7af05037fee9fb5c383d%2C33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D6%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D14%26reqt%3D1694503276682&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf159d11bd8c54e6f063be28594dd4b155e46c19f829a51e8140705dfc3f9140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:17 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 390 B
172 B 282ms
281ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=4133149457467371&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=38&didk=2366647195&sfv=1-0-40&rcs=6&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503278136&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2430424402217963%26eid%3D2430424402217963%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1101%26sap%3D1101%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D7%26at%3Dbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Drorleggertroms_com-edge-1-2430424402217963%26eb_br%3Dzero%26eba%3D1%26bv%3D25%26bvm%3D1%26bvr%3D5%26avc%3D137%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D60%26reqt%3D1694503277124%26ss38%3D1%26ss9%3D1&adks=2503113591&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd749670893155dfa0429bdf16bb442cbfe0bc80133b246e6812f2bb558161a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:18 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 142
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 303ms
303ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3814580094711857&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=39&didk=3996782115&sfv=1-0-40&rcs=6&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503278146&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D7%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3Deecf68d91e160c8f25af94b9e5441518%2C3ba982fc4238dd4197b1d51b345478dc%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D50%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C3045%2C4276%26lb%3D60%26reqt%3D1694503277141&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2606c602e7401fa915a70466942fb822af959ddeb7da0aa71a2ed9d5b5869dae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:18 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
168 B 276ms
275ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3793479879673448&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=40&didk=3995605495&sfv=1-0-40&rcs=6&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503278192&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D7%26at%3Dmbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3D096b151ba88f9705e9a9635b68fddee2%2Cb6c98a8bb15764f1c4ee331dcb724178%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D2%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D6%26reqt%3D1694503277186&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

86adbc501677eda4285824b75e3fbf606096f9de2caa6c7bd2fd5c6ee1da4a13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:18 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 308ms
308ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=566924744450986&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=41&didk=3996782115&sfv=1-0-40&rcs=7&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503278656&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D8%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3D6903f7bbc0b378e6ce4f01bb6b8387a0%2C947f1d5169cc7d0f997560e34838fb04%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D42%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%26lb%3D50%26reqt%3D1694503278653&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fc863ec0c9c7518b509a3f76ff817c9e802e9207396277af9eaf341cd8ff3b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:18 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 436ms
436ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2037225189358508&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=42&didk=3995605495&sfv=1-0-40&rcs=7&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503278700&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D5697759478229627%26eid%3D5697759478229627%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1165%26sap%3D1165%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D8%26at%3Dbf%26adr%3D399%26ezosn%3D18%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Drorleggertroms_com-box-2-5697759478229627%26eb_br%3Dzero%26eba%3D1%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26acptad%3D1%26br1%3D0%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D2%26reqt%3D1694503278696%26ss38%3D1%26ss9%3D1&adks=3783914512&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4d9119e69002f34cf5213dcbef63e4541c860e29e4b9034bec1206a24b9c7383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:19 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
168 B 293ms
293ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=3107269590389629&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=43&didk=3996782115&sfv=1-0-40&rcs=8&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503280194&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D9%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3D995216f64b1522d45dc89e428a5678fe%2C8c5ffefb122f59a66a8b7672d4452af2%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D36%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%26lb%3D42%26reqt%3D1694503279188&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d397360d6a8bb0f9e3be03903c0aa0ebaa96fc038e52bf88221b1e83467bfa2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:20 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
169 B 298ms
298ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=2633097652831697&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=44&didk=3996782115&sfv=1-0-40&rcs=9&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503280704&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D10%26at%3Dmbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3D970c8e9d60b71389609931622bd7231a%2C54d0fa6d5f6aabe7623cb24faa42a441%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D30%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%26lb%3D36%26reqt%3D1694503280702&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f56b4c420a028b3b3b9341f0f6abac72b74b17b8e14141777937c71794ea32ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:20 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 139
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 388 B
168 B 319ms
319ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1935324158499482&correlator=4446089595484964&eid=20222282&output=ldjh&gdfp_req=1&vrg=202309050101&ptt=17&impl=fif&us_privacy=1---&iu_parts=1254144%3A22794990924%2Crorleggertroms_com-box-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=45&didk=3996782115&sfv=1-0-40&rcs=10&eri=1&sc=1&cookie=ID%3Db4278eaef9bfda70%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ&gpic=UID%3D00000ca0f7db7f90%3AT%3D1694503269%3ART%3D1694503269%3AS%3DALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg&abxe=1&dt=1694503282213&lmt=1685923976&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=120&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=about%3Ablank&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&psts=AOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&ga_vid=1589597657.1694503269&ga_sid=1694503269&ga_hid=531990159&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQY0-WPwqgxSABSAghkEhkKCnB1YmNpZC5vcmcYveaPwqgxSABSAghqEhcKCHJ0YmhvdXNlGObmj8KoMUgAUgIIahIdCg5lc3AuY3JpdGVvLmNvbRjU5Y_CqDFIAFICCGQSGQoKdWlkYXBpLmNvbRjT5Y_CqDFIAFICCGQSPgoFb3BlbngSLGV5SnBJam9pVmsxTGRtdHJiMmxSWVN0bFVtTnFSMVJWUzNsS1VUMDlJbjA9GMHoj8KoMUgAEhsKDGlkNS1zeW5jLmNvbRie54_CqDFIAFICCGo.&dlt=1694503268541&idt=488&prev_scp=a%3D%257C0%257C%26iid1%3D2084978888170274%26eid%3D2084978888170274%26t%3D134%26d%3D466107%26t1%3D134%26pvc%3D-1%26ap%3D1104%26sap%3D1104%26as%3Drevenue%26plat%3D1%26bra%3Dmod228%26ic%3D11%26at%3Dbf%26adr%3D399%26ezosn%3D11%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D2%26al%3D1002%26compid%3D0%26tap%3Drorleggertroms_com-box-3-2084978888170274%26eb_br%3Dzero%26eba%3D1%26bv%3D0%26bvm%3D1%26bvr%3D9%26avc%3D137%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D0%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C5747%2C19%2C2688%2C19%2C2688%2C19%2C2688%2C3045%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C19%2C2688%2C2693%2C3045%2C3053%2C4276%2C18%2C19%2C1428%2C2688%2C2693%2C3045%2C3052%2C3053%2C3856%2C4276%26lb%3D30%26reqt%3D1694503281208%26ss38%3D1%26ss9%3D1&adks=3085313165&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202309050101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d4fef0725aade68e357f587637642a7fb99eb10d0ba8dbf8f72ecb9cf486a19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date: Tue, 12 Sep 2023 07:21:22 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://rorleggertroms.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 92577418
mc.yandex.com/watch/ 43 B
146 B 59ms
59ms Ping
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/92577418?page-url=about%3Ablank&charset=utf-8&hittoken=1694503269_c24d4021adf82a5b2a7d46f1cf9789965d3582adfd17b0cd396d5a0823f11fac&browser-info=nb%3A1%3Acl%3A497%3Aar%3A1%3Avf%3A3qm6qq812ez2u52y4wzrnbv%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1111%3Acn%3A1%3Adp%3A1%3Als%3A177422209012%3Ahid%3A470218800%3Az%3A120%3Ai%3A20230912092124%3Aet%3A1694503284%3Ac%3A1%3Arn%3A3803151%3Arqn%3A2%3Au%3A1694503269437627901%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Aco%3A0%3Acpf%3A1%3Aeu%3A1%3Ans%3A1694503266858%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1694503284&t=gdpr(14)clc(0-0-0)rqnt(2)lt(18900)aw(1)ti(0)&force-urlencoded=1

Requested by

Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Sep 2023 07:21:24 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 12-Sep-2023 07:21:24 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
content-type: image/gif
access-control-allow-origin: https://rorleggertroms.com
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 12-Sep-2023 07:21:24 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: lexicon.33across.com
URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002MpnPqAAJ&gdpr=0&src=pbjs&ver=7.39.0

Domain: capi.connatix.com
URL: https://capi.connatix.com/core/sync?v=333934&tier=1&final=true&ImplementationType=0

Domain: vid.connatix.com
URL: https://vid.connatix.com/pid-dceed97a-951e-4c47-b565-c2794ffae817/f2590cdd-0bb5-401c-a109-f286e7a52d32/1_media.bin

Domain: lit.connatix.com
URL: https://lit.connatix.com/bc0fdb4c-d321-4f31-b048-7f8fbe727deb/blockedDomains_1.bin

Domain: capi.connatix.com
URL: https://capi.connatix.com/tr/ucl?v=333934

Domain: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Domain: cds.connatix.com
URL: https://cds.connatix.com/p/333934/elements.ui.a549d09b26e367bbc8b9.js

Domain: csm.nl3.eu.criteo.net
URL: https://csm.nl3.eu.criteo.net/iev?entry=c~Gum.ChromeSyncframe.CookieRead.uid~1&entry=c~Gum.ChromeSyncframe.SidReadSuccess~1&entry=h~Gum.ChromeSyncframe.SidReadSuccessDuration~84

Verdicts & Comments Add Verdict or Comment

505 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

48 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rorleggertroms.com/	1970-01-20 14:41:45	Name: ezoadgid_466107 Value: -1
.rorleggertroms.com/	1970-01-20 14:41:50	Name: ezoref_466107 Value:
.rorleggertroms.com/	1970-01-20 23:27:19	Name: ezosuibasgeneris-1 Value: c21373d9-c8ef-4ef4-5fc6-8b566926bab0
.rorleggertroms.com/	1970-01-20 14:41:50	Name: ezoab_466107 Value: mod228
.rorleggertroms.com/	1970-01-20 14:44:36	Name: active_template::466107 Value: pub_site.1694503268
.rorleggertroms.com/	1970-01-20 14:41:45	Name: ezovid_466107 Value: 132946417
.rorleggertroms.com/	1970-01-20 14:41:45	Name: lp_466107 Value: https://rorleggertroms.com/hva-skjer-om-man-betaler-husleie-for-sent/
.rorleggertroms.com/	1970-01-20 14:44:36	Name: ezovuuidtime_466107 Value: 1694503268
.rorleggertroms.com/	1970-01-20 14:41:45	Name: ezovuuid_466107 Value: a6808c52-52cc-42fc-7467-43d06045e1ff
.rorleggertroms.com/	1970-01-20 14:41:45	Name: ezopvc_466107 Value: 1
.rorleggertroms.com/	1970-01-20 14:43:09	Name: ezepvv Value: 0
.rorleggertroms.com/	1970-01-20 23:28:45	Name: ezCMPCCS Value: false
rorleggertroms.com/	1970-01-21 00:17:43	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
rorleggertroms.com/	1970-01-21 00:17:43	Name: ezohw Value: w%3D1600%2Ch%3D1200
.rorleggertroms.com/	1970-01-21 00:17:43	Name: _ga_ZWGQ0D0G8M Value: GS1.1.1694503268.1.0.1694503268.0.0.0
.rorleggertroms.com/	1970-01-21 00:17:43	Name: _ga Value: GA1.1.1589597657.1694503269
rorleggertroms.com/	1970-01-20 15:24:55	Name: _pbjs_userid_consent_data Value: 3524755945110770
.rorleggertroms.com/	1970-01-20 23:27:19	Name: _ym_uid Value: 1694503269437627901
.rorleggertroms.com/	1970-01-20 23:27:19	Name: _ym_d Value: 1694503269
.mc.yandex.com/	1970-01-20 14:41:43	Name: sync_cookie_csrf Value: 1364893930fake
.criteo.com/	1970-01-21 00:03:19	Name: uid Value: 99ce18fa-b168-499f-8246-3c604814be6e
.rorleggertroms.com/	1970-01-20 14:42:55	Name: _ym_isad Value: 2
.openx.net/	1970-01-20 23:27:19	Name: i Value: 54c2af92-4a22-41af-9e45-c8c64d42b225\|1694503269
.mc.yandex.ru/	1970-01-20 14:41:43	Name: sync_cookie_csrf Value: 918108393fake
.rorleggertroms.com/	1970-01-21 00:03:19	Name: cto_bundle Value: lW4hMl93RTdWZVFYa2xxWTlDdyUyRldsdEtNbnI5MWZ1Mm8xUEZTNkEya0xhQXZiVnlHckxQTFAyUDAlMkIzbm9vRlJXOVlwZUhEdG1aaTV5M2g5USUyQjVKVnhWSEt5TDZXQkxuY2haS0VjYkV3cSUyQiUyQkNOeDRwSiUyRnJsckglMkZSbTQlMkZFUGFrV2ZJU1VqN08xc1VJTVFiMEdCSDhVY21yWVY0NWdreGlNSW5oTFR5OHAxUFVqbkZnJTNE
mc.yandex.com/	1969-12-31 23:59:59	Name: yabs-sid Value: 949263731694503269
.yandex.com/	1970-01-21 00:17:43	Name: i Value: HOW4FMZIYSLETVK7XlGi6yKFPVgtPz2kjHoVYfLCRYWVoVxjwrvYm8w58HcOSDDacXpyLpEeVtP+QePmt9/lDVSnvQE=
.yandex.com/	1970-01-21 00:17:43	Name: yandexuid Value: 8822592501694503269
.yandex.com/	1970-01-20 23:27:19	Name: yuidss Value: 8822592501694503269
.yandex.com/	1970-01-20 23:27:19	Name: ymex Value: 1726039269.yrts.1694503269#1726039269.yrtsi.1694503269
.yandex.com/	1970-01-20 23:27:19	Name: bh Value: KgI/MA==
.rorleggertroms.com/	1970-01-20 14:41:45	Name: _ym_visorc Value: w
.rorleggertroms.com/	1970-01-21 00:03:19	Name: __gads Value: ID=b4278eaef9bfda70:T=1694503269:RT=1694503269:S=ALNI_MaEtMMQ0BGtd_i1fnsGz74BoVyEEQ
.rorleggertroms.com/	1970-01-21 00:03:19	Name: __gpi Value: UID=00000ca0f7db7f90:T=1694503269:RT=1694503269:S=ALNI_Mbj6brOLUub858gJ1rKAZdevxw6Gg
.doubleclick.net/	1970-01-21 00:03:19	Name: IDE Value: AHWqTUkBj4uJJjkwQzvCn0_-VDkG2bbwzVKLNT22O_EJm0cK4S2yhwzKlQeHckT9ZUU
rorleggertroms.com/	1969-12-31 23:59:59	Name: ezouspvv Value: 160
rorleggertroms.com/	1969-12-31 23:59:59	Name: ezouspva Value: 1
rorleggertroms.com/	1969-12-31 23:59:59	Name: ezouspvh Value: 160
.doubleclick.net/	1970-01-20 14:41:46	Name: DSID Value: NO_DATA
.ctnsnet.com/	1970-01-20 23:27:19	Name: cid_9c1e1f9a29404ec5a49d25d4db618a36 Value: 1
.ctnsnet.com/	1970-01-20 23:27:19	Name: gid_CAESELRv54frFrIcuI81SsGRx8A Value: 1
.lijit.com/	1970-01-20 23:27:19	Name: ljt_reader Value: HTr5qGZHXsZODGhPQtyekwYs
.simpli.fi/	1970-01-20 23:28:45	Name: suid Value: 911C119B35784528879974C49D838949
.travelaudience.com/	1970-01-21 00:11:57	Name: _tracker Value: %7B%22UUID%22%3A%22CD7A8301-E482-4BB3-A465-14A92CC0C8C7%22%7D
.pubmatic.com/	1970-01-20 14:43:09	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 23:27:19	Name: KADUSERCOOKIE Value: 295031AB-B05B-4104-B591-647FBDE55F42
.turn.com/	1970-01-20 19:00:55	Name: uid Value: 4321705343130655423
.connatix.com/	1970-01-20 15:24:55	Name: cnx_userId Value: 96a84fd6f42d44eab4820c4a61933429

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ow.pubmatic.com/cookie_sync/?sec=1 Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

28816cc604642b2c32157bb5a5e5c931.safeframe.googlesyndication.com
ad.turn.com
ads.pubmatic.com
ads.travelaudience.com
ap.lijit.com
bcp.crwdcntrl.net
bshr.ezodn.com
capi.connatix.com
cd.connatix.com
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.prod.uidapi.com
cds.connatix.com
cm.g.doubleclick.net
csm.nl3.eu.criteo.net
ezodn.com
fonts.googleapis.com
fonts.gstatic.com
g.ezodn.com
g.ezoic.net
gcm.ctnsnet.com
go.ezodn.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
gum.criteo.com
id5-sync.com
image6.pubmatic.com
imasdk.googleapis.com
invstatic101.creativecdn.com
lexicon.33across.com
lit.connatix.com
mc.yandex.com
mc.yandex.ru
mug.criteo.com
oa.openxcdn.net
oajs.openx.net
onetag-sys.com
ow.pubmatic.com
pagead2.googlesyndication.com
prebid.a-mo.net
r.turn.com
region1.google-analytics.com
rorleggertroms.com
securepubads.g.doubleclick.net
static.criteo.net
sync.inmobi.com
t.pubmatic.com
tags.crwdcntrl.net
tpc.googlesyndication.com
um.simpli.fi
vid.connatix.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
capi.connatix.com
cds.connatix.com
csm.nl3.eu.criteo.net
imasdk.googleapis.com
lexicon.33across.com
lit.connatix.com
vid.connatix.com
104.18.41.104
142.250.186.34
145.40.97.67
162.19.138.116
172.64.146.152
178.250.7.13
18.66.97.88
185.64.189.226
185.64.190.78
185.64.190.84
20.127.253.7
2001:4860:4802:34::36
2001:678:cb4:bbbb::11
216.52.2.6
23.35.236.201
2600:9000:2250:4e00:a:e047:753:6381
2606:4700:10::6816:3556
2606:4700::6810:5914
2606:4700:e2::ac40:8817
2a00:1450:4001:811::2003
2a00:1450:4001:813::2002
2a00:1450:4001:813::2008
2a00:1450:4001:81c::2003
2a00:1450:4001:828::2002
2a00:1450:4001:829::2001
2a00:1450:4001:829::200a
2a00:1450:4001:82a::2004
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2001
2a00:1450:4001:830::2002
2a00:1450:4001:830::200a
2a02:2638:3::c
2a02:2638:d::2
2a02:6b8::1:119
2a05:d014:776:a63d:6339:2a28:fc90:eea
34.102.146.192
34.120.107.143
34.96.70.87
35.186.193.173
35.190.0.66
35.204.74.118
35.244.159.8
51.89.9.254
63.35.30.113
81.177.135.102
03974808d96676949618718307b5644b87c29b7b5527693b56c2960e9c56af26
05b3acaeb9ac73650a865b4d6dadbc3f81c6d0ae015c455b6a7c91b4e36dafb8
065d9427c9bd65f414d9c04f9a58a6d42aedeea64ba139fd0c1beaa30b40c368
07a7bea0a68c2563314b2e9434ec34ceaf0d1b8d4a17f5d494dc427989bc5024
08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121
096862e95687fa095052acf06c643d97aebf5a75bdb39f85061a931076b5c12e
099c8004b30c3cd38d096423267aab0133016168aaca63b761512abb03ccf1ca
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0d111d61901004eafd87c672f12f6cd54b3c376513aa672bf58100506dfe76f5
122daa1988003bd8d7ee5194b8d1da72599efc7e1550d7a369cbafb3e009d9bc
13c151da3c1ba1beea84e45b9a7f92f2b553c26c07615626a55745d5595cd42f
143d681dc8ed67d5acf692ab8bd8f25a87b411bad534980984107887c6f82af2
15f0626dd31e3e991a1c21d6304f2e370b92b3c91650de3d7ed8a38f1159a457
1742919edfb903be6f155c6f76137821d153521e7b3d38ca50403f10395e4932
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
18f41a5cdab97125db80a2b6fd5dd8da8fc63a42736d9867b769e5fe58a9931e
19cd449c87858951f691a5b9ba5a06c6d716025bc15b86d9294ba7f92dfae159
1b15a7416bc1f6771fb565f8fb122e4276ee563dbac2f9625962f352983c8d52
1b7e9a360e5833452f3b45ad216bff5126a8ac6554521f80a409e9e5a9c477f4
1ba4c0ba9bdb9ae1af9cc48965b29f9c840635586e874400825eb020de1b9370
1d581fdeaa9ddb4bdd3e34d86a525745a956368a81262030f4db346bad7ac91a
1da222840d0c513869093c5d892419db13bdbe9b2ee5a64ed96249edcfbca5b2
1f7ac379ead267382afe1258b1a23eb64bb01a4f320ca3f91a3220a01485ac96
1fce30c16d4607902b83c82fed0bb71170f49b5a5be438a92275f395328fd973
2092a90c5495f6f1b09cda9d3b3fd15aea2803a7199c17673bebe41d724795bf
23bb39b607b39a93d953762d2a618a3cbc69c52ceaf70d96890137ca1d2b0228
2462f4d85888c4301384d028b17cf96a5e6856f9639b3a0fa98b511b3cc2b0f5
2606c602e7401fa915a70466942fb822af959ddeb7da0aa71a2ed9d5b5869dae
270d68c001d05e764b3ccd047bedf93a8376bfd08b44124a67b9fa31e335cea8
2b03ee3c23565ae029ef3a8a1d0aa7edbd9a799fbe00ba6a8c5b38964dfc99f4
2becb7fb97364e92b82b3c6f729e22ce479d3c9f7bbd95a485a67dc65ab81c96
2c34f09169d2a10e8f5863960e81575ab70f88b52f4bd3386ce5e41e73a94487
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
2ea07afd59f660225e82c177586447bf9960c48e6b1beb9b810e27a0be16ed9a
3050049fe1aafe04c75e6255bc2009b096783a8a67973ed77e60288a5a573bfc
30887d75ca7268ceabc93067bca019f8ffe07189630a759407b236736e1f15af
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31782d9c0e8ae896d02c4cbd7a4a30114dd9c33a03f62cb5a8cf27d0755c3ce4
383472db86bc19b822592340828e1a9d680ece8e6a5114eb4744351081fdea3c
3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280
3aff9a1ebcc9288d03aefe8890c1c3d865fb1d51871ee9eae6ead3362b996904
3c620084286d4e8ac0ebd4811a782920ac935265c8cdbf0010ea7243bd81a6e6
3e8acce91547c5ac5db6803dbd75cf9f477d37fb340baaed261a7ebddfe68550
3eabad87392c59d00eea74d7a1f30a25275727cabb3068a445002cd3538f7113
4449b5dace51af29ca51e5e14db2b91a091aa8fbc63c0cc99af22b439a3a2cae
45e054e49a9307a05ee5b7b58684a41329a4e4ef50e773a5deacee6ce038b25e
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4774b37c87bb7b7b1783d2d8d0132457c735d603f439199c632741c572071673
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4abae5160349b782a59a2db489454c6a8a1e1eabea8ae55f265bd99a6ed607f7
4aeae812fd310d50d911d180af5378a9a436ff33c4a8de6da933e6b50572a065
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4d9119e69002f34cf5213dcbef63e4541c860e29e4b9034bec1206a24b9c7383
50f5f3646e69df042af1e9329a10076b4b5135bdff64eadb6a4b5aa3393b89a5
50fbbe164918e6fb86e26b49d99c193d1c36ec6bbf9a51b9967ca74f2282ccde
51538185c2e4c9ba2d3c6ecf161318bcaaa25346288139699212d210d23339de
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5519b950758fc3d64927f789d8cfdeca7db5982201d8dbd02b181cdfac1281a3
551bdca6b0b113022e76ca6863c5f58760ef372d7dba93b7e256591f6421250a
555628ada0ae304c558c5f3f9fba3c34a878ca8e7378fb969b225d5a084db2fc
56873ac6f099b43669478195d9faf5dfa4101ea2b41b4d0655946ea5494bdf77
5710946801913330246ddf82b742fae8d61f18cf6ad1df8d66237fe2f2b5979a
5734f1b66dcb622529d435aba20990813d43553f949bc0813719b4e7d1252527
5a22b8550806fe15b9a13c50cd4e95223df9579a533704f2fe40929674888fb2
5ab2d3fa85653d543b099ae753e3a39abe0ed6cb8f14841cd48d45f77f47e191
5b69d470ee7498e7b16f77302c5071a479877fcbb53c0b7d714983162ce0826c
5c03d27b9e5495789a06877e59880af499362ae4131c6149d0d402e147001906
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c93f77799d122fb5255ee24da285f9f228cc118cba11e6ceb2b6bda8cdf4164
5e3816e6f9588fe743d4c7bd7eec48714d42c568f16f1c3966b27e5e988f6943
5f6c6e333951f89d24a33bc7062a6946d79dae6ec80815a482b49d2d0ea036cd
6018a7484ad37a4bf1ba98dbeaf8a740d68f07387c284888a31e908a76eac97e
6260524246de2dd5a142f8741a0498a669f97e112f35728a39255b3850e03d66
626c91a33d665410e0e0cfbca6f571dc84132a5271a4d8db5eab22511e031e62
63990db6fd26af36e8efc59cdbabb74c7fb458eea166ecb9f4610a394fa7cbd6
6471b88d45d9936a2b8d2fa6b9f512f1df1c54aa1e4a76f25cacb94a0332786e
66942ef0fca01f72b5d75f7d9b1a635d2b61be546dda900186f6970c8064bb96
68947fac6fcccadf74e402aa5be850be56edeb80b1614dbd8f26a8b2eb59c978
693a447f04a2b4257d52eb5ffee55fb86c5d03a2831f7ba1a1f1f50f3d25a89b
6aae437e88be47dcbffabaec463f1e45f7708e8be9a90033fa193997268e0250
6b1113404ecd42d9bff312e1f2256a205b1c54f3b98b8955bfdb6228b67dc3ed
6fa04d8b4b07ebd5ebb250e33b532615e80dd02d46afb5cc0654c3c128b1c427
70a0d014733bcc7b6557c7dd764593432936ccc0e75d827ce94f2fff138afa8b
72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc
7b7c37ff19dc805c5f20c4d2e50383fb1311f84f9fb72e73156398cb92e8e670
7d12a9bf1fe15f8267e78800c4d420cd2012119edce1c7a2734de411fbe4c336
7fc863ec0c9c7518b509a3f76ff817c9e802e9207396277af9eaf341cd8ff3b9
82faa7a5ead139ade1fa1b11387a6dfdf881c1c3fea161df3da52a039f3662bb
84f17c357a114f92f5594d1254ef145103bd25fe28a365fc648d27678f91cdfc
85f98afdba8e7e98067f5198df27eb6a7b600ef4bb0486be0fe49ffbb326d0d0
86adbc501677eda4285824b75e3fbf606096f9de2caa6c7bd2fd5c6ee1da4a13
87143a6e228aa2039004935d4159d5e1e8ff3b6762e2d5ceeab72c04f0fb178f
87722fdd07e2f4e3f2c1c284243c530b0a65a3b7d5dadb6fe682c8ca1f6d9bce
89ae86da736ac0efd37793e8120cfeb66df971ef27b5b91b92dcb507c0b475f3
8b0ca07b422694aa63db31ba42e9dbddedeca043abc32c01c94c9231089c5d94
8b99d7ea2586a0de0fdb12cd7c01e43e0e4eac22c9f33b41161cdc84b1dda8c4
8bac631dfefdb96cf5526520c21e9ef3f585bba973970a7e62b10c945741105c
8bda09f8b4ad205fc0c53b850c619c4496a25ef3fd2ff094cfb261316d00fca1
8cd96c8ee4291db80ed9a8cc880ce6545d1e1897210cf2adf049291ccbcaa651
8d967ecbb7a58c5201803ef09bd673c7eeaff8f940c77e81ed58fa2bb34c6910
8e05b19edd1256710913ce753ee8bec113cdee2bff1fb28f9a026dfe5d12bd59
90da7c0b62fa01374005e68b4ca68df96df83d1b1d855e4548e8492cfd820de3
92d967aa9f47d13c45fa328edf25255a86f1b4cabf5673a516166a274da4c235
9343627a013971254ab1c26091c9e4ccbb08c93bcf7908d9eefb787255bdd6c5
9370adff2aa96f639d8d217bb90fd87515f03b49be1e2e3a49baee2e5e3c7402
94e88086c317722fbcd16cf8c1a012d6c267e8d0d48d75365e0e0ecc54d3f23d
988f4e8479084fd570d6c45f1aba6e511efa56bd76e2ca351265e20ca49222a8
9941d25da2d400e2cbc1c979d7ecae4a9b418158d3825d03e09650e0799dcefb
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ac858813d7cc5e56435c438fa14b9e11a00d40cc57b0a23029a768e0d4248af
9d4fef0725aade68e357f587637642a7fb99eb10d0ba8dbf8f72ecb9cf486a19
a028720a95b78e5bfe5234ef7a6a11c7e2f623a77b5a903d38dc15ca669e2865
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a5cabd806694695eeb10b48b8e5b1f4499ec46c19bbae6312284f40ce4b64b81
a84315d39fcf8e2f3f8c1f90b26a08c329044ffdccc5393617978d0b55be7baa
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ab21762c3f447aa08cbefd5ea3866165f925bd5058a9ae19e23721462de6fb60
acff18b9dd469f70f4d45d24dadf6de847a9b3abeb3e891260eb8160ffac8039
b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154
b0b88b72c10ea094d63919ed25cf812109949773de6a76200683d601434ae29b
b179b4a41f42f40b4efba5dbd5a78f47b36a2d3471a9be40aea87913865abba7
b56177bbf63fcddb09036efc3e291b1546b90a1aea07dc168229ecf7ad2b1e6f
b6e7aed079d176a0b4dac32e74a1550cb2b219410d5d9bf62295982337ae9b67
bb9ffcf770a31935ababb185f0c03b1e0db98f0ebe3676811cc9974b60915db8
bbb126b9e8714be02d4544356d79477cf8ff397bf1cc527ac6c353d4c9084dff
bc93113738e41bd3b9145ebb1dae96f3e55bd9f89f3bfdf1cc61889092625f64
bd91080d2c7f2120ad82727f5c07bbb439b810ed4035993ddb1825ca1611396b
bedbfebb1e570a307a3c53fa9922989a22aaae3602a306d66f8d1fd982496bf8
c06340de9f3beb799319aabe3751252dd687c2c194f44c3797afe72230192fdd
c0b88250724cc39a8ae30f5fb5de729cfbbbab2fe8edb77b3796c97d482ed1f4
c0d7410d5a609344ffe86a71c14012be3aa5a299cfc0ee13aad39dcad2cbe95a
c17cf68eef9ba85c4599429e87cf2416ccaf7b72baaa84a7805490bc0625eaca
c27c396b7f4c1ff33d934d2c66f082c7f81193203971648a114f862c9143c234
c2fbbf1f616091d16a20443f2fa2ffa462f075d3d803dd87d20c02aac24e5da4
c3b3856e14e07c6c2fa145b102a3b3a2d61838e0d1a9ce47e9605e5f9a9df820
c44dcb8b2fc340e7e3b88c94c8822668326fe32cdec03d7201a3245c9903a4f7
c47bbdc39af7f5ac31d9f494ef999067da7cb95cf85e69a9446792ebdc67582e
c544f4dc829eeca25b99a219eac92840ae7372c159a4321266ad45de202d96f0
c746ca687b3e79023240e45eb684f036fd9a1312b454758a6018b3ece635dafb
c8c1afb6d61df9ee5124b4cfecb321a77d9284d3cc45173c1843f25ff2ba33af
ca184070d27a37cac59eedfd1d9e69bc7fc7e28fce19b08b46094927aa60829f
cb27c6cd026e3f4d11ad71f549bcf89e80f029df5ea759589fd23fa62687f14d
ccde2d5ac6139b97afacb4becc4bd7aa254349c54b9a3c7ad176060e8d226c9e
ccebb3668d65d3268223556ecdbe14e98305dd0abeffe6308c75e7fb21188fc5
cd749670893155dfa0429bdf16bb442cbfe0bc80133b246e6812f2bb558161a6
ce94ed50bc85b66f1f7a4ba7a1f1419f87a6cf6e9bb5b8bf3f3e4c0d80cdae13
cf159d11bd8c54e6f063be28594dd4b155e46c19f829a51e8140705dfc3f9140
cfff8b14f553bbfdb463cf5bdf9b198751acfd5b106dfb0bdecddd239b9a57df
d397360d6a8bb0f9e3be03903c0aa0ebaa96fc038e52bf88221b1e83467bfa2d
daa700ae30c0d44164f3ac9dd254f381c59d2f89ec914b0be6168dd6fc42d60e
dce8ae752b8ed25d878707381a347b8889bfde191cd468eac141c5526a1f13dc
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de99dafcc09ffe0a515adab9fe4f6cad240c65e882ef0d750406b381542d3f19
dea7791f04f673748aa8e629f6475a0ee9e4b00de2f052605ae66084fee0e83a
df949af3b40e0953d28c093ffb946fce71896c8ab99baccc3d29feed58b0757c
e174a58a503ab84b3d1b9de12fd3895788204485170f1289e445f7b5b98ec789
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41cfe6a26a363a2a8e08c5f604f7b1c44ec102e8ce2a46b835bfa989a6ec3be
e611f58b19c2ff6aba81588e7b0a148e523d8acbadc40092f8de5f50dca2f93c
e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2
eaca3d36c30ebbfbf84dd9d9a319825c059384ee77801c680b530dfff2f62523
eba023a12435106e1574220485be8a3fa2215eac4fbc08233808cec8ac548ecd
ec734543fdd76f27824d57c3b4db2222d85365a0822a4df1e1620185963dedd1
ed69952ffe348c2f6bec16a4dd69124682771284fbef5b36b71e04c4c3c14873
ef6bb9abe3f4d16593818c76c607c4671a5ccf46231d128f99e4fe2bef930de2
f2e858e11bbfe82d0150dd8fc768dfdb4577415c0ee84435e0d6c51a50e6cb64
f35c7765f35ee933039a37294e629364b5907a06da6b899121be26a89089667a
f3b4e8241df13ed9ad6aef8520de1cf4af8a1c518f99353f6ad840f2e0219e6e
f3bc26d03dc5313b9df615fc465f58c0a197a045ad900aebf84ca6e819929ddd
f511fa7924776077436e0e7c47d96a420282192ee4f9c5dc96def26cb856c709
f56b4c420a028b3b3b9341f0f6abac72b74b17b8e14141777937c71794ea32ab
f57a02f763b3cc6b279df2da01ff30a52873588cc9b356eb5ab4e5f10381119a
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6363060dadef75c4795559051443181f3868f781beb33efeb93a10398d4acc8
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f9eab74c794ba8a9386ec7c8de2a9e9c01b86a55e00ac6e93a5175979a089cc8

rorleggertroms.com Open in urlscan Pro 81.177.135.102 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

214 Requests

90 %HTTPS

49 %IPv6

33 Domains

55 Subdomains

40 IPs

8 Countries

2200 kBTransfer

7006 kBSize

48 Cookies

0 Outgoing links

Redirected requests

214 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

rorleggertroms.com Open in urlscan Pro
81.177.135.102 Public Scan

Screenshot
Live screenshot

Full Image

214
Requests

90 %
HTTPS

49 %
IPv6

33
Domains

55
Subdomains

40
IPs

8
Countries

2200 kB
Transfer

7006 kB
Size

48
Cookies

214 HTTP transactions
8 data transactions