plusonbr.com Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://plusonbroficial.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwbHVzb25ici5jb20lMkZlbXByZXN0aW1vJTJGZW1wcmVzdG...
Effective URL:
https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&u...
Submission: On October 10 via manual (October 10th 2022, 4:20:50 pm UTC) from BR — Scanned from DE

Summary HTTP 173 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 30 IPs in 4 countries across 17 domains to perform 173 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is plusonbr.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on November 26th 2021. Valid for: a year.

This is the only time plusonbr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	23.23.66.23 23.23.66.23	14618 (AMAZON-AES) (AMAZON-AES)
28	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
2	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 7	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
16	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
1 30	2a00:1450:400... 2a00:1450:4001:808::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
1	2a02:2638:1::2 2a02:2638:1::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2a02:2638:1::4 2a02:2638:1::4	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
14	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.2.148 178.250.2.148	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	178.250.0.139 178.250.0.139	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
3	178.250.0.162 178.250.0.162	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::200e	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1 2	142.250.186.166 142.250.186.166	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4001:c06::5e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400e:4e::9	15169 (GOOGLE) (GOOGLE)
173	30

1 23.23.66.23 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-23-66-23.compute-1.amazonaws.com

plusonbroficial.lt.acemlna.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

plusonbr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

portalonbr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
encrypted-tbn1.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
redirector.gvt1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 2a00:1450:4001:808::2001 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:1::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:1::4 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.148 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 178.250.0.139 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.par.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 178.250.0.162 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn3.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

encrypted-tbn2.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4001:c06::5e (Council Bluffs, United States)

ASN15169 (GOOGLE, US)

csi.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400e:4e::9 (Ireland)

ASN15169 (GOOGLE, US)

r4---sn-5hnekn7s.gvt1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
44	googlesyndication.com 1 redirects pagead2.googlesyndication.com — Cisco Umbrella Rank: 131 tpc.googlesyndication.com — Cisco Umbrella Rank: 170	620 KB
28	plusonbr.com plusonbr.com	367 KB
27	gstatic.com www.gstatic.com encrypted-tbn1.gstatic.com encrypted-tbn0.gstatic.com encrypted-tbn3.gstatic.com encrypted-tbn2.gstatic.com fonts.gstatic.com csi.gstatic.com	504 KB
26	criteo.net static.criteo.net — Cisco Umbrella Rank: 789 pix.eu.criteo.net — Cisco Umbrella Rank: 5790 csm.eu.criteo.net — Cisco Umbrella Rank: 5493	137 KB
17	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 68 ad.doubleclick.net — Cisco Umbrella Rank: 219	170 KB
6	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 118	4 KB
6	criteo.com rtb.nl.eu.criteo.com — Cisco Umbrella Rank: 10350 ads.eu.criteo.com — Cisco Umbrella Rank: 5457 rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 11918 cat.nl.eu.criteo.com — Cisco Umbrella Rank: 7707	95 KB
6	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 228	265 KB
4	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 136 www.google.com — Cisco Umbrella Rank: 19	2 KB
2	gvt1.com 1 redirects redirector.gvt1.com — Cisco Umbrella Rank: 2634 r4---sn-5hnekn7s.gvt1.com	1 MB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 358	10 KB
2	google.de adservice.google.de — Cisco Umbrella Rank: 5221	914 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 94	20 KB
2	portalonbr.com portalonbr.com	4 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 1003	645 B
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 129	42 KB
1	acemlna.com 1 redirects plusonbroficial.lt.acemlna.com	390 B
173	17

	Domain	Requested by
30	tpc.googlesyndication.com	1 redirects googleads.g.doubleclick.net plusonbr.com tpc.googlesyndication.com pagead2.googlesyndication.com
28	plusonbr.com	plusonbr.com
15	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net plusonbr.com
14	static.criteo.net	ads.eu.criteo.com
14	pagead2.googlesyndication.com	plusonbr.com pagead2.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net www.googletagservices.com
9	pix.eu.criteo.net	ads.eu.criteo.com
7	www.gstatic.com	googleads.g.doubleclick.net
6	fonts.googleapis.com	cdnjs.cloudflare.com googleads.g.doubleclick.net
6	www.googletagservices.com	googleads.g.doubleclick.net
5	fonts.gstatic.com	fonts.googleapis.com
4	encrypted-tbn2.gstatic.com	googleads.g.doubleclick.net
4	encrypted-tbn1.gstatic.com	googleads.g.doubleclick.net
3	encrypted-tbn3.gstatic.com	googleads.g.doubleclick.net
3	csm.eu.criteo.net	ads.eu.criteo.com
2	csi.gstatic.com	www.gstatic.com
2	www.google.com	1 redirects tpc.googlesyndication.com
2	ad.doubleclick.net	1 redirects googleads.g.doubleclick.net
2	encrypted-tbn0.gstatic.com	googleads.g.doubleclick.net
2	cdnjs.cloudflare.com	ads.eu.criteo.com
2	cat.nl.eu.criteo.com	ads.eu.criteo.com
2	ads.eu.criteo.com	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	portalonbr.com	plusonbr.com
1	r4---sn-5hnekn7s.gvt1.com	googleads.g.doubleclick.net
1	redirector.gvt1.com	1 redirects
1	rtb.fr.eu.criteo.com	googleads.g.doubleclick.net
1	rtb.nl.eu.criteo.com	googleads.g.doubleclick.net
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.googletagmanager.com	plusonbr.com
1	plusonbroficial.lt.acemlna.com	1 redirects
173	32

This site contains links to these domains. Also see Links.

Domain
www.caixa.gov.br

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-11-26` - `2022-11-25`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.nl.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-10-10` - `2023-01-10`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-03` - `2022-11-05`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-09-27` - `2022-12-29`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-09-01` - `2022-11-30`	3 months	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-08-21` - `2022-11-23`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh

This page contains 19 frames:

Primary Page: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Frame ID: 177DA692716C337695097D9D0FA176F7
Requests: 46 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/zrt_lookup.html
Frame ID: 3295921B7C971C57D7F412A7CD644CE1
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6651189199479466&output=html&adk=1812271804&adf=3025194257&lmt=1665418844&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844401&bpp=6&bdt=396&idt=264&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3785730584727&frm=20&pv=2&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=282
Frame ID: D20E7F06103E4C1D4ADC01E7F3BE3FEF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=1213288011&adk=3554060845&adf=1797312767&pi=t.ma~as.1213288011&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844407&bpp=4&bdt=402&idt=283&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3785730584727&frm=20&pv=2&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=21Ds0znGH5&p=https%3A//plusonbr.com&dtd=288
Frame ID: BD407698D125CEFA0EF471E77FB1E522
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=7595713592&adk=560872816&adf=928226804&pi=t.ma~as.7595713592&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844411&bpp=2&bdt=406&idt=293&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=b63G1Phiaj&p=https%3A//plusonbr.com&dtd=296
Frame ID: ACB93758B359D7E0226CD1CA885D3C1C
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=8900206345&adk=4103762534&adf=2742007459&pi=t.ma~as.8900206345&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844413&bpp=2&bdt=408&idt=299&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=1853&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=cFGwVTyPMb&p=https%3A//plusonbr.com&dtd=304
Frame ID: 7291B70DE08654D846EE9EE6534394FB
Requests: 22 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=9853361210&adk=3518375593&adf=970298254&pi=t.ma~as.9853361210&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844415&bpp=1&bdt=410&idt=305&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=M4xoBJ6a2f&p=https%3A//plusonbr.com&dtd=307
Frame ID: BA8D7F0926CD127B2169B1F22D5F7238
Requests: 7 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y0RGXAAOTssIFWOGAAnrTw7RwU_2BnS-n8Z35A&u=%7C3gttlCs9sz2Rndn%2B3mzlkSK6%2FISAue9BsizGSxvNGy8%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVK9tkgAPxxwvYog0QNEMdUbsYXV1dcGut3qcQ1Q48F9vk_d2jXsYs7odqbSybdvaGUvJOx7ABr0SSHtFfzIhmvqu6rex1T5pfHVzDTbVwaO3I2DHKcFvXYw8HyuwlOILQ8zzlOrxPINwFzZhiEP6JqjQXwIDq9AE6zV1-g1dBBPGXjog9pEyLINX1hdrlrocbhhCjOXIN8Ka6wH1Srs6ccEa9tlGaNh-3xk3a3RSUeJEx1h7mWtNKBEvFaqz0BeDUouiG1olZvhLPw45l6NG8mjnDlgTkT9HywJ2XsZvofZqbarTs1xq8YjPIzACSV-5wVEg6o5FPU_EXLsuuzZa0LemMvBG9ql5y8ZQJJ7Y7TJemAdXEY-a7E6w9Bl4z3jqkIujyp85XIGBualgBHm6X0semRnTpCKA0B1jK62TekOjc-2pLDFUKUMbA1QnLmT-6yhlb2NqmIDB6XO7qcfytyZismccx44KkhIGkr4iRaXJSEPgFm-WZulUIFsn0J7jvRYlOXufwd734Z7lmzu97gISyglo3GBZldBLICSdqnmzl3jQ3Pm21K3&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBE9rXEZEY8udOYbH1fAPz9an6A7JntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAj889hfRRLA-qAMBqgTTAk_Q7k-awDcmcRnWp7bYCy0tfovvJvIKN1T2HUu7JwqEICmhcjFWAmZdMoh9tNjts-aIEPuyVJJ5wXzRjCWInCNI8CndXijx_s1GbEnHO0SrW2h7JtD42XrdT68n67v5_d66XGRvqGKKQwfXgjqo_Ii7UmtIJkdL5u26Id9rzPlT03Ivk88Vk6MhosJqErrT9lj93uOxZUHeEjLMIY3_KQ0gX8OphXHoAPqku9RJZNEE44JXcpyIKWtoRU9K-Lp-WplyvpFpWL05dWGIWNFQ-2kbMIIuYTuTIV-1w1tNn5bVjEAolpQv0_ooqsNq0_zvfFgkG6hi7x6e8TqaKM8INYK5trdgprPBSt2YsskqpXl4dXzSRt-xWHVN4u8taYlRt-1eRkgjtH4VPq3DtKBKCQ3KiRXf-FYilGE-PY0lxGGgICmMZaJjJx5YhXKXCie9PXff54AG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1J9fWvDNgDy5OdfQqqa4bgg766ug%26client%3Dca-pub-3536779329767557%26adurl%3D
Frame ID: 55D44EB3E5FDAC7FDFB4999E64208D34
Requests: 22 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y0RGXAAOIesIFWqjAArII98iIA1J_TLVU3tODA&u=%7C3gttlCs9sz0z2YvI10KaAPW1BuvOd5ubeFHbvb%2FnJZ0%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVK9tkgAPxxwvYog0QNEMdUbg59QeqwIE09K4Yk-Mk5dPYCD5gZch0CvQ5Gr66oQBMLh7vEpEfGSNsG3LZCBIlGRBR8ZTtjRaIKo6nPgWBBrHYzuWUkmWuCMj1KYy6MwBshAE4Y-q9GrMFmgPrjW2ZyFWBzokPq_pdz23XnMZMtVyj8ZYq3Saj_aY7Lq80OwrfZKVU6XKDMhua4TrauKwkwq3rmdeTMkE9ADqzNTgyJGm2PK4gkRurT3kHJx6jROzFFtpLsZ5XVv5M2MVaXbUNTF6vzO3wudeGVWLUZrddxdGDYGH3u3-cUPYOk5VnWGbIbVcNJy-QOR6PCwFqEh7XrGYyoclx6hqPKl04yib5d4vqJn5KDZk3W2qS91IfpzEifGZ9vTC_Xu0OWZxLadgGkv_TQkaX1fSnsWQTq_ZB8LOnFk-N_Bz0oh2rQNrwMtknaJw7516wuwxLVV5xfOjGpRj8vnNAZV6jDn-07HHdvHldgCE8XtLeah3EwCQwU6WSoMPtPx8ZMxZWhNOHG821wp-9xERktQfPoOAbXmlibnuehIN6p6I2zG&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCtJ1kXEZEY-vDOKPV1fAPo5CrgAbJntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAhOj1dcMSLA-qAMBqgTZAk_Q1mqZMLCyJxC6fejq4RpOtckyjmEcrYM7-73mmgL2NNHp1mfB88AWOeQbNOw_GTnfFGLfTewEFDfe9PjncYBd_f-zknGZDZK_onmeRwiuVUzlMJ5YMfbqpWXvE301j0HUEkVFoDENm2EePkcoqzTxwHu9m2Co0EJvM7ezKvNlZq0qIkbLdjZuSW3r6J6WWIPk6LU-i_ejBuxJxCGFly9pDbL2-dORVx73ImDzEJipO70LAZBvhGHlCZsqulCfYPFgAcy2llaFHKRYDtPWwGMN_r_6mvoQQ6FLHB0j07sdJ6QuyycMrVByihyFp0Sk2kceoN1_jS7_umoEKLAIMk3AiGNblgpPNayTO5ce_cYDTp5smMX4L1v8vWZ0Ua6CudQ9BMCChhBlJWQYN6_bT2aR6yUsRhrm0icU7H3ejlMPA6O_ZkdYuCWBj4fL5AUc79LfBDeYoLT1X4AG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_28BI08AtVinWG-XKgHorINUm75fg%26client%3Dca-pub-3536779329767557%26adurl%3D
Frame ID: 6994B668861B037A99D4253142AED212
Requests: 16 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html
Frame ID: F1CF6619CA124DA914454A37C3BE3F1D
Requests: 7 HTTP requests in this frame

Frame: https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B27436810.331495293;dc_pre=CLiq7dWI1voCFSqI_QcdbOQLQQ;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=
Frame ID: 7BC41B5B74663A0E4BFEF859214E631F
Requests: 8 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 79A71ECD6C61C5EEC31B1FD44A4ADCD2
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js
Frame ID: 9A883EDE170EF1C98EAC959B9EAC94AF
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1
Frame ID: 40E6003DC7AD14CF60FAE21F6DA3B394
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1
Frame ID: 1C7ED0055F345120612E2D8E0BC8BD41
Requests: 13 HTTP requests in this frame

Frame: https://www.gstatic.com/mysidia/de17d2874496eb5aa5ae962212bd52f2.js?tag=client_fast_engine_2019
Frame ID: 54E4082F7C2294AEDB68D0D640B681B3
Requests: 13 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js
Frame ID: A40340ADA5ADBFB12486E0C8A5FD199E
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 3CBF79F2316584EF457170372C405359
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 62D8E9CEE52E9439FE9E416CDDCDA1E7
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Empréstimo Caixa - Saiba Como Contratar

Page URL History Show full URLs

https://plusonbroficial.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwbHVzb25ici5jb20lMkZlbXByZX... HTTP 302
https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_sou... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

Flickity (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/flickity(?:\.pkgd)?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

173
Requests

98 %
HTTPS

83 %
IPv6

17
Domains

32
Subdomains

30
IPs

4
Countries

3727 kB
Transfer

6498 kB
Size

7
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.caixa.gov.br/Paginas/home-caixa.aspx
Title: site oficial da Caixa;

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://plusonbroficial.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwbHVzb25ici5jb20lMkZlbXByZXN0aW1vJTJGZW1wcmVzdGltby1wZXNzb2FsJTJGZW1wcmVzdGltby1jYWl4YS1zYWliYS1jb21vLWNvbnRyYXRhciUyRiUzRnV0bV9zb3VyY2UlM0RBY3RpdmVDYW1wYWlnbiUyNnV0bV9tZWRpdW0lM0RlbWFpbCUyNnV0bV9jb250ZW50JTNERS1tYWlsJTJCSW1wb3J0YW50ZSUyNTIxJTI2dXRtX2NhbXBhaWduJTNERW1wciUyNUMzJTI1QTlzdGltbyUyQjE3NCUyQi0lMkJBdGl2aWRhZGVzJTJCUmVjZW50ZXMlMkItJTJCUGVkcm8=&sig=Hy96ASeM5d9f993cz92E1TbVEt4ZnJbt7953HNZv7Lez&iat=1665241547&a=%7C%7C1001840538%7C%7C&account=plusonbroficial.activehosted.com&email=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D&s=a1bc786d1d886c2d9159e8d9ad5d38a7&i=808A821A2A2623 HTTP 302
https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 110

https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B27436810.331495293;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B27436810.331495293;dc_pre=CLiq7dWI1voCFSqI_QcdbOQLQQ;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 127

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 162

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKCXsMjb_gEQ3AYYwgMyCJoYbogAFYW3 HTTP 301
https://tpc.googlesyndication.com/simgad/14005133618456074320

Request Chain 163

https://redirector.gvt1.com/videoplayback?id=94a06898a4b786b0&itag=18&source=web_video_ads&requiressl=yes&cmo=secure_transport=yes&ip=0.0.0.0&ipbits=0&expire=1665426046&sparams=ip,ipbits,expire,id,itag,source,requiressl&signature=6E3815C1C7F27BF62B66BB108F9EF19A78A7F9C4.18A8F9D9A37A1576B217620F8A4C592DED7C1FED&key=ck2 HTTP 302
https://r4---sn-5hnekn7s.gvt1.com/videoplayback?id=94a06898a4b786b0&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1665426046&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=0141379BED10E9F3EADD759D046112DF9C2D2D8B.22E2852F39CDA3098974D3954E92804FE9B476C2&key=cms1&cms_redirect=yes&mh=tM&mip=2a03:1b20:6:f011::2e&mm=28&mn=sn-5hnekn7s&ms=nvh&mt=1665417699&mv=u&mvi=4&pl=48

173 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/
Redirect Chain

https://plusonbroficial.lt.acemlna.com/Prod/link-tracker?redirectUrl=aHR0cHMlM0ElMkYlMkZwbHVzb25ici5jb20lMkZlbXByZXN0aW1vJTJGZW1wcmVzdGltby1wZXNzb2FsJTJGZW1wcmVzdGltby1jYWl4YS1zYWliYS1jb21vLWNvbnRy...
https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+17...

52 KB
12 KB

246ms
177ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e51db2c2c8969d3de4a96cd461d9739cdd14ece15dc2ae4ce8573bbc8986f3c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public
cf-cache-status: DYNAMIC
cf-ray: 7580af5deb72925c-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 10 Oct 2022 16:20:43 GMT
link: <https://plusonbr.com/wp-json/>; rel="https://api.w.org/" <https://plusonbr.com/wp-json/wp/v2/posts/1750>; rel="alternate"; type="application/json" <https://plusonbr.com/?p=1750>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
protected: by MS22092901
referrer-policy: no-referrer-when-downgrade
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HCwMjQJCWJFDy3VhH%2F%2BnNEkELRaX4e1SJmx75s42tJX%2FbYJy9h3GJcZmz9zaozRltUmRz8gD1uycbcCw%2BAJB3jelGQEXZzEOCpevgeIzRLjNUPqej0dDOrccv5Zs4Stb8zAgeP5Nn0kIJrk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15768000;
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-download-options: noopen
x-micro-cache: MISS
x-xss-protection: 1; mode=block

Redirect headers

content-length: 0
content-type: application/json
date: Mon, 10 Oct 2022 16:20:43 GMT
location: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
x-amz-apigw-id: Zy_uUFUXIAMFnPQ=
x-amzn-requestid: 1467e4e0-aadc-4d37-8084-394700bba316
x-amzn-trace-id: Root=1-6344465b-6f5fbffd1d210487594f5118;Sampled=0

GET
H2 200 style.min.css
plusonbr.com/wp-includes/css/dist/block-library/ 87 KB
12 KB 64ms
63ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-includes/css/dist/block-library/style.min.css?ver=3.0

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 13 Jul 2022 03:24:05 GMT
server: cloudflare
etag: W/"62ce3ad5-15b64"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=llHR8TrFEEaf0mYLL17BgjQ5T3xRuxZwePH933MiFpDejoqY%2Bpmev%2Fcr7nQMSIm2t0z2AyCv%2B5dMY53LE2n9%2FDd4eQmQbCBxIxd0VnFpUHJf%2FPJ0E7C3lfxfRutU%2BcvU4C0jK6IR6SPleTM%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 7580af5f0d37925c-FRA

GET bootstrap.min.css
plusonbr.com/wp-content/themes/plusonbr/css/ 0
0

GET
H2 200 style.css
plusonbr.com/wp-content/themes/plusonbr/ 36 KB
8 KB 120ms
118ms Stylesheet
text/css 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9baad53f219743e2e36c716ba90adba1990a9715d6efc18f3cb870cbfc8a33cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 11 Jun 2022 15:20:45 GMT
server: cloudflare
etag: W/"62a4b2cd-91fd"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: text/css
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tmu%2BbcJLVVdLz%2Byp48LkN91Jk97l7CNvHYHg3%2FdNJGq8ng1pZpCpLYXFptQcKXuOtsVg6ejo4N1hZ27xjuqWt3gBrKh%2FzODAgVG7H%2FUGcQdG0PVqIpmFpjna%2F2O3DK2alfSpYKsYnKM723s%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 7580af5f1d3c925c-FRA

GET
H2 200 jquery.min.js Show response
plusonbr.com/wp-includes/js/jquery/ 87 KB
32 KB 30ms
29ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3700
x-dns-prefetch-control: on
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 20 Jul 2021 17:38:23 GMT
server: cloudflare
etag: W/"60f70a0f-15db1"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YDJJeK1Uqavrxup4mdB7fJHCmWLYSwl0cCGEc1Yhd5TrlMgHto7%2FjOjCczta%2FjSJMPvP%2FbF1aB6rduxnKEZpCQyjwC5T8jdRgQ0Nr7DLgw%2BoxFrliJuNgJeztEYzy49kn%2FVnCsrFHTAiITs%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 7580af5f1d3d925c-FRA

GET
H2 200 jquery-migrate.min.js Show response
plusonbr.com/wp-includes/js/jquery/ 11 KB
5 KB 60ms
59ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: cloudflare
etag: W/"5fb4e3fe-2bd8"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Luql7izj1pon9AZrNsIK%2Bnb%2BKM%2FkATGs6BuSgpamllNRR2tH6LGh5%2F%2FpuQ%2ByN%2BmdKFjhd5bCpfkuAxLl0xrZ5ziv9ELH8G91nbN3W7JNNuMpQuGPnJoB27EtlJIAkk79%2BSlNjryv0KrY850%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 7580af5f1d40925c-FRA

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 162 KB
53 KB 227ms
123ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6651189199479466

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6491192e35a930b0fd7f7e3ce91d056dc582c53f7ba120daf66308d529075d3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Origin: https://plusonbr.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54649
x-xss-protection: 0
server: cafe
etag: 16121082409207331945
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 16:20:44 GMT

GET
H3 200 logo.png
plusonbr.com/wp-content/uploads/2021/08/ 8 KB
9 KB 39ms
35ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/08/logo.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c94e1e3f15da3b3acb696439f1d416428913fd41b65df297dced70c43c665799

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63363
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8190
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Aug 2021 13:42:43 GMT
server: cloudflare
etag: "6107f653-1ffe"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jB%2F6V%2FX4KEf99ljya3%2F%2BdxR%2FPC8%2Fd%2BBSRUVWng%2FaVDhpZX9xPlVQ%2FrJDUUziUBmwWUAqOlauKL8PgT5uEwmIldNyAXzpB%2FJaIsK7R6LTww4czS2zkdhf34NqeDVMHe4s0A07n1Mhqv4GBZw%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee589b71-FRA

GET
H3 200 Emprestimo-Santander-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 11 KB
11 KB 85ms
82ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Emprestimo-Santander-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bbd3e92ed859e9a02580195e28bb3414f12fb672eee769dc3d1e7b686b607ee4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10885
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 29 Jun 2022 18:45:37 GMT
server: cloudflare
etag: "62bc9dd1-2a85"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ho5unVDBJeu0SKySNwfNci4Rr4nPH%2BX%2BFpJWpc9ODRADhPoIO9w8YeVolpSUC1ZAqaiiVhjYJBSyLwxpRxB6I%2BsDQzTJcCcLRS7VTt68fdrdUggOVjfDseFn8XqpjXSlg%2BQ2zulifftuuzE%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee599b71-FRA

GET
H3 200 Emprestimo-Neon-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 8 KB
9 KB 91ms
85ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Emprestimo-Neon-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

361b799e6c913489b31748cf8475527e7f0de5052a86d4808901da32182f1d27

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8567
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 29 Jun 2022 17:30:24 GMT
server: cloudflare
etag: "62bc8c30-2177"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kDh6KAG8Oqe3u6B0cVvGpwtZfqEpsyhI%2FjAysEaiweCaal0muDWjSbFNdEvtlQRVXPpxVYg5fxGjTZb6XGISYSkDPX9tr094r%2FMDUHDE2xEqvHzK00YQu2y5daiSfYMwtlBmfVt%2ByczdDZU%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee5f9b71-FRA

GET
H3 200 Emprestimo-Livre-Digital-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/07/ 13 KB
14 KB 105ms
99ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-Livre-Digital-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

21d050f59058aaa9dca7fd9afb374aabe8c21125febad6d7d7239fc21b2cae73

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13609
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 01 Jul 2022 18:02:47 GMT
server: cloudflare
etag: "62bf36c7-3529"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VKsxMXbyxW57EYGGp5kYWXlnO8sh4erKjIpX35fX5zD0Ks2V0kPJTwrPRfVq9LclDiOPrt6HXvfdBEnVsUZEt976AmHa%2Bv2XGGrRt7AJr8qbv03gRx4u8pAiWPJkuqK7v%2BcOm%2BnzDc9TUGE%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee619b71-FRA

GET
H3 200 Emprestimo-BV-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/11/ 17 KB
17 KB 94ms
88ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/11/Emprestimo-BV-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

881aa40e19c2f5a971e46838651eacbe303d5d1f86a4c015b6d20fd707d55991

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17046
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Jul 2022 15:21:29 GMT
server: cloudflare
etag: "62c06279-4296"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oRxGRRMw%2FAURx1%2FbRvYQJN0PEv98mdMyM%2BPt%2FMolQuB1h8z10mlo08lWfTTzzYeNLIobUePWSjnttdP251V%2BY7p%2FQhOtalfRs0NfobZCG1rAlC8cDdZgKBRKcW50%2FFm4DXjFZMp9WHOXOAY%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee639b71-FRA

GET
H3 200 Emprestimo-PicPay-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 10 KB
11 KB 97ms
91ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Emprestimo-PicPay-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5d283c43475751b50be2beddc94b041d094813f630b555bdc29d5565ecc44e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10598
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Jul 2022 12:36:42 GMT
server: cloudflare
etag: "62c03bda-2966"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2BL2ISKP0ood8miWVmeOySWD3rns%2BQ8mQTo9IfXa0MIK%2BWna1N1dfSJqygtxc6yIB0H0sxodEWMxGl2yiHfsd52ti4PyxWRjpZMun6RjY9UEAfla81SPCdptMq3g%2BrRVkoA4RcGM1t0c8Ns%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee649b71-FRA

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 162 KB
54 KB 171ms
68ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3536779329767557

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f831d49514009bef4e365507bafda17a510bf08bbab99af7423d3a47fa8b742d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Origin: https://plusonbr.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54652
x-xss-protection: 0
server: cafe
etag: 11955057880742300971
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 16:20:44 GMT

GET
H3 200 Emprestimo-Caixa-1.jpg
plusonbr.com/wp-content/uploads/2021/12/ 51 KB
52 KB 101ms
95ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Emprestimo-Caixa-1.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

11897f9c64bbd6118277253f82a0ce4e6679fe2db704ddd8821f304f7df5de6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 52363
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 20 Dec 2021 12:15:20 GMT
server: cloudflare
etag: "61c073d8-cc8b"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6R4YfAD7IUYykSOrrFX016yLAQe7XUXXP7LVimjagOyw1LGuCmQn8tD4MK5ziQYsqAacaubmiPZx88XbgRjkecxq1t5HVcN2eSqfR79GC387YCXZ65s565MZB4ZjJv6f0BJpc0wMIWhUjIE%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee689b71-FRA

GET
H3 200 Emprestimo-BMG-285x211.jpg
plusonbr.com/wp-content/uploads/2021/11/ 9 KB
10 KB 112ms
106ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/11/Emprestimo-BMG-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a67069ae225c6ddecfa04ce2abd1694e6c3f886c214bdab1f3913d03ddeb1d7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9290
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Jul 2022 15:48:53 GMT
server: cloudflare
etag: "62c068e5-244a"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RcInPE70E%2FVGFq5ZnBmDOuRrjrtw0f0AkTfMLz6F1gwf6ubLDPLzd3v2pRjJDxk3n8i5UUZTZ%2FsbbyXIuLj5ZMbVOmlSVzvzl6jHzhZQLOH1VbrVaQyztFYBEGtV5KoZVR2%2Fv2rqab78T1I%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee6a9b71-FRA

GET
H3 200 Microcredito-Caixa-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 12 KB
13 KB 114ms
109ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Microcredito-Caixa-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

505186de1197eaf2e3d1c4dc2cd77e77549ea15d52b94d261f3029181e7e38ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12686
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 20 Dec 2021 16:39:47 GMT
server: cloudflare
etag: "61c0b1d3-318e"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tOx2yeGuZrZIz86rMbYHeTeoSSQZ1381uxkJFe6uYxGp5qfe%2BmSrbuoBHvXBp922H7sKIQHtDnRgIlaj4BC7k3%2BV5ws%2FedFSpCWUCRSoSmgjdwpf3lPzjc9qfIlL4LqpeYDvv4bcZS2ad4U%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee6b9b71-FRA

GET
H3 200 Emprestimo-Bom-pra-Credito-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 8 KB
9 KB 116ms
110ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Emprestimo-Bom-pra-Credito-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b93a6ce124c9ca036cce77ee84dc26d578cb04610fec20dca1a0983aeceb73c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8285
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 29 Jun 2022 17:18:33 GMT
server: cloudflare
etag: "62bc8969-205d"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ErbKcmC5ibk9FwhbAdxuPFvL4nbfGvMBx0k%2BS60txDBwm9nRHZK7C9s7Xc7tckBCeJkKEtNcJn1Ic0EwDMGo9P7MB7Ai0B8WSvWYotWEwhYPz9dxH7p5rT1%2BWgn07cSaL3lSzduBQQ%2Fs6NM%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee719b71-FRA

GET
H3 200 Emprestimo-BV-2-285x211.jpg
plusonbr.com/wp-content/uploads/2021/11/ 19 KB
20 KB 117ms
111ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/11/Emprestimo-BV-2-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7bc67b2d52b0a5c493421b99be51b76dd33a8f7a71b8f683ce836cfae44e0c9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19513
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Jul 2022 15:23:20 GMT
server: cloudflare
etag: "62c062e8-4c39"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=db4rZPOx30KXL4ZqOYtzt2zGCfpEmTkoow8ayOIRQJwYUO7tkJv5JjNSV2N1%2BNwGYzP1rEu4XpundwcA120DucbTX0IEcJxCSbdAU0BrrgYhUzMTRJJHc%2B7Z0WTo3gwrjChgm96FKv1jIg4%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee739b71-FRA

GET
H3 200 Emprestimo-Pessoal-Nubank-2-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 16 KB
16 KB 119ms
113ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Emprestimo-Pessoal-Nubank-2-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccaa0c13277452c5548a11750e8b67f62c0c7ceacf978b76a1905858543d76d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16112
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 29 Jun 2022 17:48:52 GMT
server: cloudflare
etag: "62bc9084-3ef0"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6xXNDaZIMqadL%2FSRE5LglbAMt5tYH4UlDPm07NaMiTfSsZNAYaNPebbOqB7YWmSQacT8K12zCJhQMXvsmzWqJzbSyylOXnZ9rk5XYWqSp3SscjeDr9kQgUY%2F%2BpGZQBvHRRaxetRJRdDPVeM%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee779b71-FRA

GET
H3 200 Emprestimo-Original-285x211.jpeg
plusonbr.com/wp-content/uploads/2021/11/ 11 KB
12 KB 121ms
115ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/11/Emprestimo-Original-285x211.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97287fd3a406ce6bea920d6021e13bee0f5b56755e5150f0bfc95a1c3b5a953a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11336
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 24 Nov 2021 14:12:05 GMT
server: cloudflare
etag: "619e4835-2c48"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j1Y5Zl2goqyG1G2oGPrqecT6dhZqjUsDn1X5sn5I9S6IgKQT%2B0nYmee7ero2K5wc%2FYe5yhBPBzKUpPuC%2BpmdHFW3D7pgV%2BLJB58w7R9bV72Akqy%2BYCTDWOenlYBTUMeghkLeoICc5TodQp4%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee7a9b71-FRA

GET
H3 200 Natura-2-285x211.jpg
plusonbr.com/wp-content/uploads/2021/08/ 17 KB
18 KB 67ms
61ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/08/Natura-2-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4bb8d34ce6536015de2e59677b929760357767d2964672a5bca5bbb25c7c9fe6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63363
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17905
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 04 Jul 2022 15:34:55 GMT
server: cloudflare
etag: "62c3089f-45f1"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X0UoOvs2UHk0NhVW%2BUc19BZw0%2FHGfUDYhabp9GSwAyNBtGLN%2F%2FjztbfIhn2v7XO0vPW9lN5TjPKGVa09Gh9YY0mKaypQBiXSEEHAeE2bR8x%2BAGqEWyGL5fV2knJEZJ9BdeKloE67f3SktNY%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee829b71-FRA

GET
H3 200 Bolsa-Familia-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/11/ 11 KB
12 KB 123ms
116ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/11/Bolsa-Familia-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

63d3f0bd5db6372e190e1fb8ee9819a257d3cdc392c1137ea2054e65d164751d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11361
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 04 Nov 2021 11:41:27 GMT
server: cloudflare
etag: "6183c6e7-2c61"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jtaKmD%2FGVDnw6z0PykjVa5XiPXgDULZAhWUW%2F04ih1NzvXO5oJQj0KGKVKhc94BeLWe1%2F4m9HdIUbbt5evy1JII9DBVoYS7zrV%2BsHF1YO%2Bgm%2B1i2CLwqP%2B7LAk2diTOOF82RUtqOui3W4fE%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee849b71-FRA

GET
H3 200 Cartao-Nubank-2-285x211.jpg
plusonbr.com/wp-content/uploads/2021/08/ 17 KB
18 KB 45ms
39ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/08/Cartao-Nubank-2-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

40baed6f32e40e90913b6983441c9c3af9a1c2fd393693bf5a2e9f64b743d65a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63363
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17791
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 04 Jul 2022 17:08:33 GMT
server: cloudflare
etag: "62c31e91-457f"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ReCBLi3pg1say4YoF9J2pNkZlW3FLFXYEPsRY4idwx8Zlru3dkfPNL7tGcBXQMbr3SETX4sISJDRjACS9H2bh%2FZ87XZ3F%2Blo%2BZQv%2BbFvnUgms%2FGSSrIGGMtRVC%2BhxYWmYZXrdcw9bQRLi2E%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee869b71-FRA

GET
H3 200 Cartao-de-Credito-Caixa-3-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 12 KB
13 KB 126ms
119ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Cartao-de-Credito-Caixa-3-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e672f29f8e1e3b07e8a026f24d29924cf60203932c29f52cb1df9fae6b5aa66b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12616
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 29 Jun 2022 17:12:18 GMT
server: cloudflare
etag: "62bc87f2-3148"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qwwlkj0K%2BQcN1Fu2Rfd2Ht5zhYGLveeqJfuCsF%2BjMAscooEf1moBJyw9JCm5krgY%2BLx4OWUkMmKVKdnH1ISeHT3Lmw0ps3YGwBwwuWyd36EIW7QtitkQ0mYf18rufA%2BnW%2FI3uTd7LMvwFH8%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee8a9b71-FRA

GET
H3 200 Cartao-Nubank-Ultravioleta-2-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 14 KB
14 KB 127ms
120ms Image
image/jpeg 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Cartao-Nubank-Ultravioleta-2-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

54d92a5c6b1f986c1514ce8249674a3dde39d2b665843551140f9e29bc015d79

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13874
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 02 Jul 2022 13:18:32 GMT
server: cloudflare
etag: "62c045a8-3632"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/jpeg
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GTmr%2Bwoz%2FqNeGsCnQYNO64zO07R2hP4%2FiWhqcEoEv4sImKMwyfyaNBDME7ceDRO2n85BFDw13E29SptA2eIt53tt3GPgbXv3Z9zv7EGZmFhB4npZnanBmWqwQksd36HLc0jrsVryENHehNg%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee8b9b71-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 153ms
53ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-216073346-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b9b050bf255ed6f28b588a1ad88c328a7dd0baea698d11fa2eb09296c97bb9e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42399
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 10 Oct 2022 16:20:44 GMT

GET
H3 200 flickity.js Show response
plusonbr.com/wp-content/themes/plusonbr/js/ 54 KB
15 KB 28ms
28ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-content/themes/plusonbr/js/flickity.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c126bc13a8986f1a9ac0cfd1cd67280a5ae0eca52d4519fe702b7cf85c76a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63363
x-dns-prefetch-control: on
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 04 Feb 2022 16:12:51 GMT
server: cloudflare
etag: W/"61fd5083-d7cb"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XsjdtroqXjJyygTuU7uBk5%2F%2FKNSd0ej8WUwvLyfAZq6glnDwzJliYIbDoSL52vkIL0NEfTlQse1xlTTXKHWrZLEhv8oKaxqiLx0uatMccUVnGjHtbZ%2Fx7lvWbS09LFMh5c9v%2B%2BlVhM3f6Ls%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 7580af5fbe179b71-FRA

GET
H3 200 funcoes.js Show response
plusonbr.com/wp-content/themes/plusonbr/js/ 926 B
1 KB 32ms
31ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-content/themes/plusonbr/js/funcoes.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d393fee4858d73610ef9ac7d9b9788f75147371523b18dc66ed92e62e1cf4e5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63363
x-dns-prefetch-control: on
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 04 Feb 2022 16:12:51 GMT
server: cloudflare
etag: W/"61fd5083-39e"
protected: by MS22092901
x-download-options: noopen
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gdeEYjdBRxhOAOWrI9nEJ4SVbnxbuCeY1naZm8RlHlJOioqQLR7BdT0fgRqxA3ieumIi2gSO9AFk3EnB3qmYPV3B8GB%2B4bgHQQL9JfsMEOKna0h%2BfKCJ19DuoIGHa8WdsGP57SB9S4gsWRM%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: max-age=315360000
cf-ray: 7580af5fde339b71-FRA

GET
H3 200 wp-emoji-release.min.js Show response
plusonbr.com/wp-includes/js/ 18 KB
5 KB 128ms
122ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 63363
x-dns-prefetch-control: on
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 25 May 2022 03:24:24 GMT
server: cloudflare
etag: W/"628da168-48b9"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: application/javascript; charset=utf-8
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QBQxWYvErJg8TxWOPWGzzPMRmlvRAksA%2BlHj0p2dbFjqXMiyz5NTVqLGEr5dYJNToXJJymGYlh0PHXAcKd3tNb%2BDDqbgDFBBA54m2NGrB%2FZUHiZjTPdFYiCXXejAlD%2B5M64kK4To8waFDgI%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
cf-ray: 7580af5fee8d9b71-FRA

GET
H3 200 search.png
plusonbr.com/wp-content/themes/plusonbr/img/ 550 B
1 KB 129ms
123ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/themes/plusonbr/img/search.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bff94fc53b0367730ae0231d3ac6897ca493f98652f95613d5a2ee94d71eadb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 550
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 04 Feb 2022 16:12:51 GMT
server: cloudflare
etag: "61fd5083-226"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iCeLqsbocqN5Cu4GtfJTP4NjET6b7AN1Rv2L%2Bl3z0SwGyl1D6vboYaztfAmnJgFcAP5ttZatIkAuobFXSCbmHhYQQe47b4EvOsJ%2BYd7qCs37frjk6sphYbDM%2BwgeikhYIfsibh8K%2Bc4sfO8%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee8e9b71-FRA

GET
H3 200 topoSeparaMenu.png
plusonbr.com/wp-content/themes/plusonbr/img/ 184 B
773 B 129ms
123ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/themes/plusonbr/img/topoSeparaMenu.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9a760bb7f2b48d3f293dcb65b77aa6404ca9c381bb581c0fe393282316fc336

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 184
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 04 Feb 2022 16:12:51 GMT
server: cloudflare
etag: "61fd5083-b8"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UusKzH48K0%2FCyxfpOUFU8ZFvRSqhLvBklIIburkyawz2%2FtkqoJAKTIOHaqI4HgUNsMTar30V3qFFH4M8ElZF0tRkGANuubbRxq2rmxrBSnjrPmLguc3g5a%2Fe0gylGNBh0Tm0PHyyduCXDAU%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af5fee8f9b71-FRA

GET
H2 200 next.png
portalonbr.com/wp-content/uploads/ 1 KB
2 KB 152ms
39ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://portalonbr.com/wp-content/uploads/next.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0f453bafbbba6a39685a4ac97a1dc89773da2adadf8940763ff4ad70a4aba5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1328
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 18 Mar 2021 02:53:13 GMT
server: cloudflare
etag: "6052c099-530"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GsSUB97onaLJZbiPkhpasWL3iR953ufiWPP7xOTnFPoE6F0gESpbyJqJihFTUzcYpO7Ui3gOzY8yzzxGL5jojIEXaE1jOGOd5%2B7gIkcmXh3FUbMfm7xvNz9QQv%2BW1CWyoqP0wGsi0kZXJ3xkfg%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af60b93a90f4-FRA

GET
H2 200 right.png
portalonbr.com/wp-content/uploads/ 1 KB
2 KB 133ms
19ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://portalonbr.com/wp-content/uploads/right.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a981d1cf29a578baf94ef901db9a17e0f078f407d4133a806c465682ede97fc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/plusonbr/style.css?v=1665418843
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
strict-transport-security: max-age=15768000;
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 71026
x-dns-prefetch-control: on
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1301
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 18 Mar 2021 02:53:13 GMT
server: cloudflare
etag: "6052c099-515"
x-download-options: noopen
vary: Accept-Encoding
protected: by MS22092901
content-type: image/png
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GJ0kDo4VQdV6%2BXjmY2UTRWWdV0bUKoNliquYvJv9kEepP7Qg2llk8rGGNP8PRrNhVAXifU2l07qHy%2BRTar1A5kDxuxcj%2BoV7%2BDNEVy41GlrRKixluOGAwfcXAx4KNLSvy43wTP7I4%2F6xGD2t8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 7580af60b94090f4-FRA

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 127ms
38ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-216073346-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Oct 2022 15:01:59 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 4725
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Mon, 10 Oct 2022 17:01:59 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/ 349 KB
115 KB 169ms
90ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6651189199479466&plah=plusonbr.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3536779329767557

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cac39331fda1036b58d952e0ea6cc7acb5e9509b52b8f5a870cf0285e05609b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117220
x-xss-protection: 0
server: cafe
etag: 9061333971316160208
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 16:20:44 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/ Frame 3295 10 KB
5 KB 124ms
38ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221003/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-3536779329767557

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 75488
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 09 Oct 2022 19:22:36 GMT
etag: 9671129459699598864
expires: Sun, 23 Oct 2022 19:22:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 124ms
45ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=256536801&t=pageview&_s=1&dl=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&ul=en-us&de=UTF-8&dt=Empr%C3%A9stimo%20Caixa%20-%20Saiba%20Como%20Contratar&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAACAAI~&jid=2072725262&gjid=1482502745&cid=146803945.1665418845&tid=UA-216073346-1&_gid=1998835640.1665418845&_r=1&gtm=2oua50&z=1606880210

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://plusonbr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
645 B 259ms
48ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=plusonbr.com&callback=_gfp_s_&client=ca-pub-6651189199479466

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6651189199479466&plah=plusonbr.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d5fbe98d157dc691140d47dbf46f151800660611986144365cfc1606d7ad940f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 201
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 255ms
47ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=plusonbr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 256ms
48ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=plusonbr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D20E 263 KB
58 KB 1589ms
1394ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6651189199479466&output=html&adk=1812271804&adf=3025194257&lmt=1665418844&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&ea=0&pra=5&wgl=1&easpi=0&asntp=0&asntpv=0&asntpl=0&asntpm=0&asntpc=0&asna=5&asnd=5&asnp=5&asns=5&asmat=1&asptt=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844401&bpp=6&bdt=396&idt=264&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=3785730584727&frm=20&pv=2&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=282

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65ef5266036fa6fae953a70874220873bb6b7063ff7dc8039ca05d28b77434cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 59598
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:46 GMT
expires: Mon, 10 Oct 2022 16:20:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BD40 23 KB
10 KB 998ms
814ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=1213288011&adk=3554060845&adf=1797312767&pi=t.ma~as.1213288011&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844407&bpp=4&bdt=402&idt=283&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3785730584727&frm=20&pv=2&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=21Ds0znGH5&p=https%3A//plusonbr.com&dtd=288

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cfb0cbf98ae7fa9420eb0a6fe7a23d383171e3c61fa3cc8c37c35bd61d0d8f69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 9979
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:45 GMT
expires: Mon, 10 Oct 2022 16:20:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame ACB9 134 KB
43 KB 1364ms
1193ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=7595713592&adk=560872816&adf=928226804&pi=t.ma~as.7595713592&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844411&bpp=2&bdt=406&idt=293&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=b63G1Phiaj&p=https%3A//plusonbr.com&dtd=296

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9874f5642b434d93b208329bca413f7cf45382049fae420ead50829666718625

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CL2sndWI1voCFdhlFQgdWAYEJA&gqi=XEZEY6aON8e2tge2uKhI&layout=/sadbundle/%24csp%253Der3%24/18240062200895701296/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 43958
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CL2sndWI1voCFdhlFQgdWAYEJA&gqi=XEZEY6aON8e2tge2uKhI&layout=/sadbundle/%24csp%253Der3%24/18240062200895701296/index.html
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:46 GMT
expires: Mon, 10 Oct 2022 16:20:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7291 134 KB
35 KB 1287ms
1125ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=8900206345&adk=4103762534&adf=2742007459&pi=t.ma~as.8900206345&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844413&bpp=2&bdt=408&idt=299&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=1853&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=cFGwVTyPMb&p=https%3A//plusonbr.com&dtd=304

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c0a100f5d8169a2a979d5a017b087b39173f51f2b4f63322715ed8c789b905ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 35933
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:45 GMT
expires: Mon, 10 Oct 2022 16:20:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BA8D 23 KB
10 KB 982ms
826ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=9853361210&adk=3518375593&adf=970298254&pi=t.ma~as.9853361210&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844415&bpp=1&bdt=410&idt=305&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=M4xoBJ6a2f&p=https%3A//plusonbr.com&dtd=307

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3d4518e77779f56120a95d2858574aefe5c1fb5f89bcf26bdd308e6869d3167

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 10006
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:45 GMT
expires: Mon, 10 Oct 2022 16:20:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame BD40 3 KB
1 KB 144ms
49ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=1213288011&adk=3554060845&adf=1797312767&pi=t.ma~as.1213288011&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844407&bpp=4&bdt=402&idt=283&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3785730584727&frm=20&pv=2&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=21Ds0znGH5&p=https%3A//plusonbr.com&dtd=288

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:16:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:16:30 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame BD40 17 KB
8 KB 131ms
37ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 326
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:19 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BD40 142 KB
45 KB 146ms
53ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 16:20:45 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame BD40 0
0 85ms
84ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C8SSvXEZEY8udOYbH1fAPz9an6A7JntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAj889hfRRLA-qAMBqgTQAk_Q7k-awDcmcRnWp7bYCy0tfovvJvIKN1T2HUu7JwqEICmhcjFWAmZdMoh9tNjts-aIEPuyVJJ5wXzRjCWInCNI8CndXijx_s1GbEnHO0SrW2h7JtD42XrdT68n67v5_d66XGRvqGKKQwfXgjqo_Ii7UmtIJkdL5u26Id9rzPlT03Ivk88Vk6MhosJqErrT9lj93uOxZUHeEjLMIY3_KQ0gX8OphXHoAPqku9RJZNEE44JXcpyIKWtoRU9K-Lp-WplyvpFpWL05dWGIWNFQ-2kbMIIuYTuTIV-1w1tNn5bVjEAolpQv0_ooqsNq0_zvfFgkG6hi7x6e8TqaKM8INYK5trdgprPBSt2YsskqpXl4dXzSRt-xWHVN4u8taYlRt-1eRkgjtH4VPq2BtoHYjoJWmqpD7PXyqcfGNJkvcmuOOKs4rZ_F1aFGqWoSoKOugoAG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMzUzNjc3OTMyOTc2NzU1NxgA&sigh=t_iIUScwtWo&uach_m=[UACH]&cid=CAQSGwDq26N9jSWRgVVpQlAgCM31Dk7zVDysQuoVphgBIBM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=1213288011&adk=3554060845&adf=1797312767&pi=t.ma~as.1213288011&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844407&bpp=4&bdt=402&idt=283&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3785730584727&frm=20&pv=2&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=21Ds0znGH5&p=https%3A//plusonbr.com&dtd=288
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 16:20:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 10 Oct 2022 16:20:45 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame BD40 0
0 50ms
14ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=kLeyEsz6ROwGmAKdg2ICAgAAAGWYnDTL0O4QEFxGRGPqYaNpDe18apcmsgASAAA&wp=Y0RGXAAOTssIFWOGAAnrTw7RwU_2BnS-n8Z35A

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 229445
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 55D4 186 KB
53 KB 184ms
152ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y0RGXAAOTssIFWOGAAnrTw7RwU_2BnS-n8Z35A&u=%7C3gttlCs9sz2Rndn%2B3mzlkSK6%2FISAue9BsizGSxvNGy8%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVK9tkgAPxxwvYog0QNEMdUbsYXV1dcGut3qcQ1Q48F9vk_d2jXsYs7odqbSybdvaGUvJOx7ABr0SSHtFfzIhmvqu6rex1T5pfHVzDTbVwaO3I2DHKcFvXYw8HyuwlOILQ8zzlOrxPINwFzZhiEP6JqjQXwIDq9AE6zV1-g1dBBPGXjog9pEyLINX1hdrlrocbhhCjOXIN8Ka6wH1Srs6ccEa9tlGaNh-3xk3a3RSUeJEx1h7mWtNKBEvFaqz0BeDUouiG1olZvhLPw45l6NG8mjnDlgTkT9HywJ2XsZvofZqbarTs1xq8YjPIzACSV-5wVEg6o5FPU_EXLsuuzZa0LemMvBG9ql5y8ZQJJ7Y7TJemAdXEY-a7E6w9Bl4z3jqkIujyp85XIGBualgBHm6X0semRnTpCKA0B1jK62TekOjc-2pLDFUKUMbA1QnLmT-6yhlb2NqmIDB6XO7qcfytyZismccx44KkhIGkr4iRaXJSEPgFm-WZulUIFsn0J7jvRYlOXufwd734Z7lmzu97gISyglo3GBZldBLICSdqnmzl3jQ3Pm21K3&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBE9rXEZEY8udOYbH1fAPz9an6A7JntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAj889hfRRLA-qAMBqgTTAk_Q7k-awDcmcRnWp7bYCy0tfovvJvIKN1T2HUu7JwqEICmhcjFWAmZdMoh9tNjts-aIEPuyVJJ5wXzRjCWInCNI8CndXijx_s1GbEnHO0SrW2h7JtD42XrdT68n67v5_d66XGRvqGKKQwfXgjqo_Ii7UmtIJkdL5u26Id9rzPlT03Ivk88Vk6MhosJqErrT9lj93uOxZUHeEjLMIY3_KQ0gX8OphXHoAPqku9RJZNEE44JXcpyIKWtoRU9K-Lp-WplyvpFpWL05dWGIWNFQ-2kbMIIuYTuTIV-1w1tNn5bVjEAolpQv0_ooqsNq0_zvfFgkG6hi7x6e8TqaKM8INYK5trdgprPBSt2YsskqpXl4dXzSRt-xWHVN4u8taYlRt-1eRkgjtH4VPq3DtKBKCQ3KiRXf-FYilGE-PY0lxGGgICmMZaJjJx5YhXKXCie9PXff54AG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1J9fWvDNgDy5OdfQqqa4bgg766ug%26client%3Dca-pub-3536779329767557%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

6b6390404934b4ad66937933ac9d4a605b5e8acbbbdbda8c3a9fa6e074577878

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:44 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=Cj7UAnRzUULUBIeShc0B4voF9nZpBgU6_20mHhaTPs5md2g-0PSMf_B0XnMmbjdX5w6a8XvQfOS5aEl-6anaMyaeNVcuMC5Q7TZ6_vVYQFysvkRTavPk-ljw15_j_t1C7EgxFX8Uwo3bdrIuJpf0-9Sy2wmufw4CWI8cZe-NBw7f7-WoPlWbFkkAMsgWCBWoFrS357cIwgkifs8C5_PS2RNeeojst0yhtLk-maiGu7xup863zorAAWGFxFASWfrqKZxU2A"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 131382839
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame BA8D 3 KB
1 KB 128ms
45ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=9853361210&adk=3518375593&adf=970298254&pi=t.ma~as.9853361210&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844415&bpp=1&bdt=410&idt=305&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=M4xoBJ6a2f&p=https%3A//plusonbr.com&dtd=307

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:16:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 255
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:16:30 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame BA8D 17 KB
7 KB 123ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 326
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:19 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame BA8D 142 KB
44 KB 183ms
102ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 16:20:45 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame BA8D 0
0 86ms
86ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=COykFXEZEY-vDOKPV1fAPo5CrgAbJntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAhOj1dcMSLA-qAMBqgTWAk_Q1mqZMLCyJxC6fejq4RpOtckyjmEcrYM7-73mmgL2NNHp1mfB88AWOeQbNOw_GTnfFGLfTewEFDfe9PjncYBd_f-zknGZDZK_onmeRwiuVUzlMJ5YMfbqpWXvE301j0HUEkVFoDENm2EePkcoqzTxwHu9m2Co0EJvM7ezKvNlZq0qIkbLdjZuSW3r6J6WWIPk6LU-i_ejBuxJxCGFly9pDbL2-dORVx73ImDzEJipO70LAZBvhGHlCZsqulCfYPFgAcy2llaFHKRYDtPWwGMN_r_6mvoQQ6FLHB0j07sdJ6QuyycMrVByihyFp0Sk2kceoN1_jS7_umoEKLAIMk3AiGNblgpPNayTO5ce_cYDTp5smMX4L1v8vWZ0Ua6CudQ9BMCChhBlJWQYN6_bT2bT6QS-wZV6wZiI-N4Os_X3Cre10E12oKc1R7ptFroCw8parrOLH4AG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMzUzNjc3OTMyOTc2NzU1NxgA&sigh=XosPOxUzydI&uach_m=[UACH]&cid=CAQSGwDq26N9SenNZEFBiYiPnZj-yb8bi95X2oUrYRgBIBM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=9853361210&adk=3518375593&adf=970298254&pi=t.ma~as.9853361210&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844415&bpp=1&bdt=410&idt=305&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=3203&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=M4xoBJ6a2f&p=https%3A//plusonbr.com&dtd=307
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 16:20:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 10 Oct 2022 16:20:45 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame BA8D 0
0 78ms
44ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kLeyEsz6ROwGmAKdg2ICAgAAAAqyC7IeptDEEFxGRGO-_AOZ86i0JvKiIAASAAA&wp=Y0RGXAAOIesIFWqjAArII98iIA1J_TLVU3tODA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
server-processing-duration-in-ticks: 182641
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 6994 118 KB
42 KB 120ms
102ms Document
text/html 2a02:2638:1::4
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Y0RGXAAOIesIFWqjAArII98iIA1J_TLVU3tODA&u=%7C3gttlCs9sz0z2YvI10KaAPW1BuvOd5ubeFHbvb%2FnJZ0%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVK9tkgAPxxwvYog0QNEMdUbg59QeqwIE09K4Yk-Mk5dPYCD5gZch0CvQ5Gr66oQBMLh7vEpEfGSNsG3LZCBIlGRBR8ZTtjRaIKo6nPgWBBrHYzuWUkmWuCMj1KYy6MwBshAE4Y-q9GrMFmgPrjW2ZyFWBzokPq_pdz23XnMZMtVyj8ZYq3Saj_aY7Lq80OwrfZKVU6XKDMhua4TrauKwkwq3rmdeTMkE9ADqzNTgyJGm2PK4gkRurT3kHJx6jROzFFtpLsZ5XVv5M2MVaXbUNTF6vzO3wudeGVWLUZrddxdGDYGH3u3-cUPYOk5VnWGbIbVcNJy-QOR6PCwFqEh7XrGYyoclx6hqPKl04yib5d4vqJn5KDZk3W2qS91IfpzEifGZ9vTC_Xu0OWZxLadgGkv_TQkaX1fSnsWQTq_ZB8LOnFk-N_Bz0oh2rQNrwMtknaJw7516wuwxLVV5xfOjGpRj8vnNAZV6jDn-07HHdvHldgCE8XtLeah3EwCQwU6WSoMPtPx8ZMxZWhNOHG821wp-9xERktQfPoOAbXmlibnuehIN6p6I2zG&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCtJ1kXEZEY-vDOKPV1fAPo5CrgAbJntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAhOj1dcMSLA-qAMBqgTZAk_Q1mqZMLCyJxC6fejq4RpOtckyjmEcrYM7-73mmgL2NNHp1mfB88AWOeQbNOw_GTnfFGLfTewEFDfe9PjncYBd_f-zknGZDZK_onmeRwiuVUzlMJ5YMfbqpWXvE301j0HUEkVFoDENm2EePkcoqzTxwHu9m2Co0EJvM7ezKvNlZq0qIkbLdjZuSW3r6J6WWIPk6LU-i_ejBuxJxCGFly9pDbL2-dORVx73ImDzEJipO70LAZBvhGHlCZsqulCfYPFgAcy2llaFHKRYDtPWwGMN_r_6mvoQQ6FLHB0j07sdJ6QuyycMrVByihyFp0Sk2kceoN1_jS7_umoEKLAIMk3AiGNblgpPNayTO5ce_cYDTp5smMX4L1v8vWZ0Ua6CudQ9BMCChhBlJWQYN6_bT2aR6yUsRhrm0icU7H3ejlMPA6O_ZkdYuCWBj4fL5AUc79LfBDeYoLT1X4AG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_28BI08AtVinWG-XKgHorINUm75fg%26client%3Dca-pub-3536779329767557%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::4 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a9c9bead427bcdc4ece27146575b004e44566f105a07d4a931def635ae2b1f44

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:45 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=WCTrb3RzUULUBIeS7y4_gIlOI7VGbIBM7QDzCAMw6fW_tQmfI3d-9og2k1k-6G_COdAFeKu2pbr_HQqswKcCOAamu6Ggi2WEMvRcUZRFRYGwbV9nET2eghnDdC7vnYoTFc28rzHFMmufEYYOARqPwNvIFzNuwg7wzI1ddxcdYKDI5sx-nwbozbRmhRTrOwKuM_MO5EDOcmMqMD9EKiYs4fof9cecVOvt9JpvOdnYrzVMbwaaWiOv3hkwoCYzyLxUclmcQQ"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 77132092
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame BD40 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d347720208b19529428789a7431ae2951d603c160bb0f865def7b9d0431ffa78

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 6994 2 KB
1 KB 72ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y0RGXAAOIesIFWqjAArII98iIA1J_TLVU3tODA&u=%7C3gttlCs9sz0z2YvI10KaAPW1BuvOd5ubeFHbvb%2FnJZ0%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVK9tkgAPxxwvYog0QNEMdUbg59QeqwIE09K4Yk-Mk5dPYCD5gZch0CvQ5Gr66oQBMLh7vEpEfGSNsG3LZCBIlGRBR8ZTtjRaIKo6nPgWBBrHYzuWUkmWuCMj1KYy6MwBshAE4Y-q9GrMFmgPrjW2ZyFWBzokPq_pdz23XnMZMtVyj8ZYq3Saj_aY7Lq80OwrfZKVU6XKDMhua4TrauKwkwq3rmdeTMkE9ADqzNTgyJGm2PK4gkRurT3kHJx6jROzFFtpLsZ5XVv5M2MVaXbUNTF6vzO3wudeGVWLUZrddxdGDYGH3u3-cUPYOk5VnWGbIbVcNJy-QOR6PCwFqEh7XrGYyoclx6hqPKl04yib5d4vqJn5KDZk3W2qS91IfpzEifGZ9vTC_Xu0OWZxLadgGkv_TQkaX1fSnsWQTq_ZB8LOnFk-N_Bz0oh2rQNrwMtknaJw7516wuwxLVV5xfOjGpRj8vnNAZV6jDn-07HHdvHldgCE8XtLeah3EwCQwU6WSoMPtPx8ZMxZWhNOHG821wp-9xERktQfPoOAbXmlibnuehIN6p6I2zG&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCtJ1kXEZEY-vDOKPV1fAPo5CrgAbJntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAhOj1dcMSLA-qAMBqgTZAk_Q1mqZMLCyJxC6fejq4RpOtckyjmEcrYM7-73mmgL2NNHp1mfB88AWOeQbNOw_GTnfFGLfTewEFDfe9PjncYBd_f-zknGZDZK_onmeRwiuVUzlMJ5YMfbqpWXvE301j0HUEkVFoDENm2EePkcoqzTxwHu9m2Co0EJvM7ezKvNlZq0qIkbLdjZuSW3r6J6WWIPk6LU-i_ejBuxJxCGFly9pDbL2-dORVx73ImDzEJipO70LAZBvhGHlCZsqulCfYPFgAcy2llaFHKRYDtPWwGMN_r_6mvoQQ6FLHB0j07sdJ6QuyycMrVByihyFp0Sk2kceoN1_jS7_umoEKLAIMk3AiGNblgpPNayTO5ce_cYDTp5smMX4L1v8vWZ0Ua6CudQ9BMCChhBlJWQYN6_bT2aR6yUsRhrm0icU7H3ejlMPA6O_ZkdYuCWBj4fL5AUc79LfBDeYoLT1X4AG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_28BI08AtVinWG-XKgHorINUm75fg%26client%3Dca-pub-3536779329767557%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 6994 2 KB
1 KB 85ms
30ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 6994 308 B
636 B 80ms
28ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 6994 293 B
621 B 79ms
27ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 6994 43 B
348 B 55ms
18ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=8-O3KDoB7TCCTMqLYakkUYvsUH5DAs8Wz_HZ5OhnLe6ytIbgywdqa6OeAZ2GcuTwZB7thteMO2OWeTLUnmWmRC8E-KW8Kza-TQGTOM5PGwOFkAf8TDOvXleXM_6cYXO4MPnuD76xKxilypv2K92t2tqvfU_X1mcL_xuNLDYU-L5VdXFpuKEZvTGNgS6V_zWNut9nYKGUJyD071CWegj1QRUWXmYoWRQXFUsiKW29hX41VE7zpOy0HC1tXdiYU0QmH8437OZeX9278P_ybOEA9VY2tDL2FRlqIBf3b_RNS2pPL9_8rggau0RsSMYDwDoOWHLMMiI0p1qC06sfxa5UQEFRvEdmjGD7woqpZwuj8eIAPM9eZiTLiCtJqfRsChseBPh0nkA4QdsR5cYRFRaO0FWEf-3nQldURF5CMoe6r_oGAf8x

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3396141
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame BA8D 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a008ec2c2e404617fa956991b5eaf0d1b50cf2728cadeece8e74d9e3dd399931

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 6994 12 KB
5 KB 41ms
22ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 393001
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FXAV3glFpbF%2BjKphFLKP%2FvnpEgmkizLY4Dene9Urw9DDzCURkZlAZCWcGiRDGxmW51zTcpRbhd6xWVc5z%2FmBT5Jqs%2FBX01g7GhtzWMEwST8eCKpk2MPGo3V01Zzupdv9BaDHC2I0i0EhyG0MiAUEdg0d"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7580af6aeb4d8fe0-FRA
expires: Sat, 30 Sep 2023 16:20:45 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 6994 12 KB
6 KB 48ms
16ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 6994 8 KB
8 KB 55ms
16ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=556&m=0&partner=36918&q=80&r=0&u=http%3A%2F%2Fstatic.nl.eu.criteo.net%2Fdesign%2Fdt%2F36918%2F210225%2F33d784040a48408e8c6dedc4aa03c63b_logo_leasingmarkt_de_endorsement.png&v=3&w=196&s=bV7eT_BQdCtHYe9XVj2QlQ_C

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5cdaf6aae2dabbdc998aa46fe673b49e901ec1810832273aeb47ae58e1e7b003

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30806178
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8168
expires: Mon, 02 Oct 2023 05:37:04 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 6994 9 KB
10 KB 55ms
17ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=36918&q=80&r=0&u=https%3A%2F%2Fwww.leasingmarkt.de%2Fad%2F7024428%2Fmedia%2Ffeed%2F600x450&v=3&w=800&s=AaHfGyXjrTQaRIfPud9NKpp5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

71b5cbdbfcee0b19b5e47c6741c9360958ee4108ec3f89a5b56afdc0e1118395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 9636
expires: Thu, 05 Oct 2023 16:20:45 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 6994 0
128 B 55ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=WCTrb3RzUULUBIeS7y4_gIlOI7VGbIBM7QDzCAMw6fW_tQmfI3d-9og2k1k-6G_COdAFeKu2pbr_HQqswKcCOAamu6Ggi2WEMvRcUZRFRYGwbV9nET2eghnDdC7vnYoTFc28rzHFMmufEYYOARqPwNvIFzNuwg7wzI1ddxcdYKDI5sx-nwbozbRmhRTrOwKuM_MO5EDOcmMqMD9EKiYs4fof9cecVOvt9JpvOdnYrzVMbwaaWiOv3hkwoCYzyLxUclmcQQ&sds=2&rev=83041&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 6994 2 KB
1 KB 40ms
27ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 6994 2 KB
1 KB 25ms
24ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 55D4 2 KB
1 KB 18ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Y0RGXAAOTssIFWOGAAnrTw7RwU_2BnS-n8Z35A&u=%7C3gttlCs9sz2Rndn%2B3mzlkSK6%2FISAue9BsizGSxvNGy8%3D%7C&c1=TEbw32HdmhlTb08vzaRE05Nor-kWNW37ds0oDHxEuxeKn7Xrp6ainli_Cmw5dJSudhYAqTqyTVK9tkgAPxxwvYog0QNEMdUbsYXV1dcGut3qcQ1Q48F9vk_d2jXsYs7odqbSybdvaGUvJOx7ABr0SSHtFfzIhmvqu6rex1T5pfHVzDTbVwaO3I2DHKcFvXYw8HyuwlOILQ8zzlOrxPINwFzZhiEP6JqjQXwIDq9AE6zV1-g1dBBPGXjog9pEyLINX1hdrlrocbhhCjOXIN8Ka6wH1Srs6ccEa9tlGaNh-3xk3a3RSUeJEx1h7mWtNKBEvFaqz0BeDUouiG1olZvhLPw45l6NG8mjnDlgTkT9HywJ2XsZvofZqbarTs1xq8YjPIzACSV-5wVEg6o5FPU_EXLsuuzZa0LemMvBG9ql5y8ZQJJ7Y7TJemAdXEY-a7E6w9Bl4z3jqkIujyp85XIGBualgBHm6X0semRnTpCKA0B1jK62TekOjc-2pLDFUKUMbA1QnLmT-6yhlb2NqmIDB6XO7qcfytyZismccx44KkhIGkr4iRaXJSEPgFm-WZulUIFsn0J7jvRYlOXufwd734Z7lmzu97gISyglo3GBZldBLICSdqnmzl3jQ3Pm21K3&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBE9rXEZEY8udOYbH1fAPz9an6A7JntKxXM2jlvdwwI23ARABIABgleKQgqAHggEXY2EtcHViLTM1MzY3NzkzMjk3Njc1NTfIAQmpAj889hfRRLA-qAMBqgTTAk_Q7k-awDcmcRnWp7bYCy0tfovvJvIKN1T2HUu7JwqEICmhcjFWAmZdMoh9tNjts-aIEPuyVJJ5wXzRjCWInCNI8CndXijx_s1GbEnHO0SrW2h7JtD42XrdT68n67v5_d66XGRvqGKKQwfXgjqo_Ii7UmtIJkdL5u26Id9rzPlT03Ivk88Vk6MhosJqErrT9lj93uOxZUHeEjLMIY3_KQ0gX8OphXHoAPqku9RJZNEE44JXcpyIKWtoRU9K-Lp-WplyvpFpWL05dWGIWNFQ-2kbMIIuYTuTIV-1w1tNn5bVjEAolpQv0_ooqsNq0_zvfFgkG6hi7x6e8TqaKM8INYK5trdgprPBSt2YsskqpXl4dXzSRt-xWHVN4u8taYlRt-1eRkgjtH4VPq3DtKBKCQ3KiRXf-FYilGE-PY0lxGGgICmMZaJjJx5YhXKXCie9PXff54AG06bnscrUpr6kAaAGIagHipixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1J9fWvDNgDy5OdfQqqa4bgg766ug%26client%3Dca-pub-3536779329767557%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 55D4 2 KB
1 KB 20ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 55D4 308 B
636 B 16ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 55D4 293 B
621 B 17ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Thu, 05 Oct 2023 16:20:45 GMT

GET
H2 200 lg.php
cat.nl.eu.criteo.com/delivery/ Frame 55D4 43 B
347 B 17ms
17ms Image
image/gif 178.250.2.148
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl.eu.criteo.com/delivery/lg.php?cppv=3&cpp=rFm_xToB7TCCTMqLYakkUYvsUH6Q58pca73CghXdhrhqxTr3d0hCyAQozxLcWIXEQzCaNqYtd6Rw3YvIEJKlI5_6bUtDg0nJsg7RpAD1ZRMBfa-jcOvqnHF_G1MW532TZ08e5t0ol_2Rx4VzSzajEC5nOxTkfqcVlgCN5tkAlr7a9ZpT2v4Czzzu_rV6BJ3IC5Jcryyz8WHvg5FVSdSm1NRHt_5H8peVwwxh_qdgr7IMw_ZKTEX-rWWLmvxOt_nuLlS46r_uW5NA0syJTBiKiP9V3LiLlT8mHPKfzna63ewguIGDPAjAdh5sgRArxFptfyN5TWsBvHcpM2g5fP2vyiNAVrgnifhq1xyzzqr35I-AUhwciaEI5E2ilJM2eeCB0O4CY3xhW4pn5qV7_zgpjtbU6x7Mur3bLjLQlu7AljcWK70x

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.148 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2812576
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 6994 4 KB
1 KB 133ms
48ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3f714f28225e03c64ce6cd24eb1f076426d54a0c7bdadd813b590013008b9f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 14:58:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 55D4 12 KB
5 KB 45ms
27ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 393002
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BsxCU78wtr8kCH%2BW9nZvV6Z1%2BnVQ0EUMqQHPa27gpC%2FL37y62zDojzmzedM9%2Fh0acxk4rX7gGbI0EObTEf22vnS37RIum8mZb8Trx7hnNqZl%2FjjqqB0zaIZ9LgoFAH1O05upPs4844gFnBinYJ%2BZGlyp"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7580af6bbe979067-FRA
expires: Sat, 30 Sep 2023 16:20:46 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 55D4 12 KB
6 KB 22ms
22ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:46 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 55D4 8 KB
8 KB 18ms
18ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

5cdaf6aae2dabbdc998aa46fe673b49e901ec1810832273aeb47ae58e1e7b003

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30806178
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8168
expires: Mon, 02 Oct 2023 05:37:04 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 55D4 14 KB
15 KB 21ms
20ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=36918&q=80&r=0&u=https%3A%2F%2Fwww.leasingmarkt.de%2Fad%2F7267223%2Fmedia%2Ffeed%2F600x450&v=3&w=800&s=Or_m8GGLCnc5MKV1B8DpAe_Q&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2ec41b7caaa3188dd4dae26cb4642386f6f602f75e828ef2cd57ede98d9892e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2164329
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 14670
expires: Fri, 04 Nov 2022 17:32:55 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 55D4 14 KB
15 KB 38ms
37ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=36918&q=80&r=0&u=https%3A%2F%2Fwww.leasingmarkt.de%2Fad%2F7241990%2Fmedia%2Ffeed%2F600x450&v=3&w=800&s=6Ts7Zp-jK6NKfa-LIn9h0jHJ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

2ec41b7caaa3188dd4dae26cb4642386f6f602f75e828ef2cd57ede98d9892e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1645204
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 14670
expires: Sat, 29 Oct 2022 17:20:50 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 55D4 12 KB
12 KB 25ms
24ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=36918&q=80&r=0&u=https%3A%2F%2Fwww.leasingmarkt.de%2Fad%2F7023813%2Fmedia%2Ffeed%2F600x450&v=3&w=800&s=g_LZSobZ-WMYCFJAPE-0HM-N&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0eae38a44ef9db61dcf9781fc876cd43d32e28640dd2e69caf1085d44bb4a095

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11788
expires: Thu, 05 Oct 2023 16:20:46 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 55D4 11 KB
11 KB 24ms
23ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=36918&q=80&r=0&u=https%3A%2F%2Fwww.leasingmarkt.de%2Fad%2F7064037%2Fmedia%2Ffeed%2F600x450&v=3&w=800&s=I4UZshTJHwhYaA4aT0Gb4xVw&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

93eaf3820b1994575c05968a517e97557b3aa318ab184195aec06b4446122f99

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1778536
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 11246
expires: Mon, 31 Oct 2022 06:23:02 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 55D4 14 KB
14 KB 27ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=36918&q=80&r=0&u=https%3A%2F%2Fwww.leasingmarkt.de%2Fad%2F6925701%2Fmedia%2Ffeed%2F600x450&v=3&w=800&s=hnfTbcO8dOLtaNRBmpX1r1hw&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

0d8c3cc19e9958f985a4c5ae2d0f098706cf42b259e6e0a40fae39434dbc3e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2040505
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 13850
expires: Thu, 03 Nov 2022 07:09:11 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 55D4 20 KB
20 KB 36ms
35ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=36918&q=80&r=0&u=https%3A%2F%2Fwww.leasingmarkt.de%2Fad%2F7280678%2Fmedia%2Ffeed%2F600x450&v=3&w=800&s=ud63fMa0hV0HfOLqdenDlK8t&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.par.vip.prod.criteo.com

Software

Finatra /

Resource Hash

9d33b9b60ad4b3d47a0a695ff8453951b970c9146a9498d5e0833a5723a972ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2317833
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 20564
expires: Sun, 06 Nov 2022 12:11:19 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 55D4 0
127 B 16ms
16ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=Cj7UAnRzUULUBIeShc0B4voF9nZpBgU6_20mHhaTPs5md2g-0PSMf_B0XnMmbjdX5w6a8XvQfOS5aEl-6anaMyaeNVcuMC5Q7TZ6_vVYQFysvkRTavPk-ljw15_j_t1C7EgxFX8Uwo3bdrIuJpf0-9Sy2wmufw4CWI8cZe-NBw7f7-WoPlWbFkkAMsgWCBWoFrS357cIwgkifs8C5_PS2RNeeojst0yhtLk-maiGu7xup863zorAAWGFxFASWfrqKZxU2A&sds=2&rev=83041&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Oct 2022 16:20:45 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 55D4 2 KB
1 KB 23ms
23ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:46 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 55D4 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 05 Oct 2023 16:20:46 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 7291 2 KB
608 B 64ms
48ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=8900206345&adk=4103762534&adf=2742007459&pi=t.ma~as.8900206345&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844413&bpp=2&bdt=408&idt=299&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=1853&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=cFGwVTyPMb&p=https%3A//plusonbr.com&dtd=304

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

582c2586c49819d9dfe5cb88653679a40bf930ca86f1dc01a4afd821a9eab97e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 15:51:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 7291 2 KB
902 B 117ms
38ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:55 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame 7291 23 KB
9 KB 118ms
38ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 7291 3 KB
1 KB 141ms
71ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 7291 17 KB
7 KB 139ms
59ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 327
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:19 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7291 142 KB
44 KB 154ms
74ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H2 200 ff28bd887d5918000d85a256eb9567a4.js Show response
www.gstatic.com/mysidia/ Frame 7291 32 KB
14 KB 122ms
38ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff28bd887d5918000d85a256eb9567a4.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a61fe6e2743a18f977ac18a2f805735e8dccf115b16dbbbd2e3864ae98d4c33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 10:33:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 452863
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13740
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 21:54:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 03 Jan 2023 10:33:03 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7291 0
0 82ms
82ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CT-OHXEZEY-j0N-WDmwfJzb3ADvyNgr9soYeq7ccQyIqnu6IyEAEgy9fhdWCV4pCCoAegAfC9xvYDyAEJqQI_PPYX0USwPqgDAcgDywSqBN8CT9AHlsEjmk-sci2lJFZpZSASLn2eAfjkXaWlOxH1AxzbV8A25o6WH5qQvCJ3o-pK6V7CMpuDuRmcx2yWJyNaAu8hq-hXmpq3DYsbYACabuuAxQjwI3H33FGOIXVGsLIbnDXiLr8HQK3It79rgwmNWGM9oWdab7SOXOhUa9NISzqGMwzWLdePAdsy3DAKMY6gLQiSYtmnTFQ7f5g3W11XcjmbCQ8Syu3K_kVPKtZbFVJ8oUmToDoHtwJpQ6hbQJdH13dDV0GtQNHoww8nN0bAn8qADFkQi2GRByDBT7m1IzhXmV8Zyy-Wib1XiLjobQAOnVW9oG_V0S-wSEp9QZyVEDfPoXJjlRunwSye6zMNXS3oBPvMY4AQbGOFBaYo888je8Wm7cMBIqYF2QGmxaxvHviRyT6xLZ3fi3wCRSDH4JylbdQ5aUfE-NbiewyevghuNAfaTw27sWWFeASf81JDwATPp8WlhQSSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH-MG5CagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB6a-G9gHAPIHBBCpkQTSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTC9AVAZgWAYAXAbIXHAoaCAASFHB1Yi0zNTM2Nzc5MzI5NzY3NTU3GAA&sigh=gaafDlBS-ww&uach_m=[UACH]&template_id=494

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=8900206345&adk=4103762534&adf=2742007459&pi=t.ma~as.8900206345&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844413&bpp=2&bdt=408&idt=299&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=1853&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=cFGwVTyPMb&p=https%3A//plusonbr.com&dtd=304
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 16:20:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 7291 12 KB
12 KB 147ms
37ms Image
image/jpeg 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcSvO-aJqmVjYMOLo2OIhrT0bNXouuv2nK0DUtaBiw5LmLdyXMw&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89e9d69772a59c9cd2bfc22b5cf63164124a2905c4cd38877637eab8d023a900

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 01:09:01 GMT
x-content-type-options: nosniff
age: 313905
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11948
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 02:37:03 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 07 Oct 2023 01:09:01 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 7291 15 KB
15 KB 125ms
37ms Image
image/jpeg 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcRB0Fv3AsUKK1Mu6o9-DonmOCgmGFu0atr42-XaMX2WMz__-qE&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8fb2f9f4c18d7e10bab89be6081bdbba389c34a7d7f10b5f90c805766b22906f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 09:11:44 GMT
x-content-type-options: nosniff
age: 371342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14873
x-xss-protection: 0
last-modified: Sun, 08 Nov 2020 03:30:05 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 06 Oct 2023 09:11:44 GMT

GET
H2 200 shopping
encrypted-tbn0.gstatic.com/ Frame 7291 64 KB
64 KB 134ms
46ms Image
image/jpeg 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn0.gstatic.com/shopping?q=tbn:ANd9GcSROsaweG7p4b5nrs1NsW6OZ1sFKY1rYglFXvJ_FoZthB-tfVIodH8gsufMQQ&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a58d79d1433b460d45a481a87382b317345042eff066c0625f00fa9f561e63c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 06:26:16 GMT
x-content-type-options: nosniff
age: 294870
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65566
x-xss-protection: 0
last-modified: Fri, 28 Jan 2022 23:34:54 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 07 Oct 2023 06:26:16 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 7291 21 KB
21 KB 138ms
43ms Image
image/jpeg 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcTP-lgBRHkeS6e1Ja9tYvYdgkHjuDKM_gXJNyMTFUGhzRua7K5y&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

627475466ee35774e9f30511f127a579062d52edbf0e649da618d7dba95c861a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 03:19:57 GMT
x-content-type-options: nosniff
age: 133249
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21799
x-xss-protection: 0
last-modified: Wed, 22 Jun 2022 07:23:52 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Mon, 09 Oct 2023 03:19:57 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 7291 35 KB
35 KB 216ms
107ms Image
image/jpeg 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcT4Yz3qYveRNlGTu3RQCVq1om2294Iy_RKBD2YUzH3-pEgKq5tnc0WgTM3c9us&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87d341106f6c056e7c4a0558d38f1ea50ebb7d3cf1fb9cb0bd1417aba2a07680

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 08:52:31 GMT
x-content-type-options: nosniff
age: 286095
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35654
x-xss-protection: 0
last-modified: Thu, 06 Jan 2022 02:51:08 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 07 Oct 2023 08:52:31 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 7291 10 KB
10 KB 131ms
36ms Image
image/jpeg 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcS-3pahcbqNa9WsHFonbDfWqCvAx93GRHy_AFpNY05zM4GW3_A&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb45c4a2484fd9cca288778c942f258c2185ec97445b4e5ddf8e2dbae6f481d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 23:10:44 GMT
x-content-type-options: nosniff
age: 234602
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9759
x-xss-protection: 0
last-modified: Thu, 12 May 2022 03:36:18 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 07 Oct 2023 23:10:44 GMT

GET
H2 200 shopping
encrypted-tbn3.gstatic.com/ Frame 7291 11 KB
12 KB 131ms
37ms Image
image/jpeg 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcT1EZx7yAGkwlX3jRT2aCVZuWH0cJoUyYrzQGXNUD2c_02Gsc4&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9e3e02bb5848279882d86ee9acb89c42501bad923eee8342e191f58e30987d12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 15:39:29 GMT
x-content-type-options: nosniff
age: 348077
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11242
x-xss-protection: 0
last-modified: Sun, 26 Jun 2022 04:22:37 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Fri, 06 Oct 2023 15:39:29 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 7291 15 KB
15 KB 136ms
42ms Image
image/jpeg 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcR_lXCrA0ct0G3cLBDQ0Z_84QD2LMJ2IS3xTJk8ZgDAKtwiZ-0&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20d25490828875caa4383cfa086c7efd6e0abdb4f482078a3abed65ee7cac965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 14:55:55 GMT
x-content-type-options: nosniff
age: 523491
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15047
x-xss-protection: 0
last-modified: Fri, 18 Feb 2022 06:33:45 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 04 Oct 2023 14:55:55 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 7291 58 KB
59 KB 192ms
84ms Image
image/jpeg 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcQxXYXwHp1CLaOqkQHVGIP0XtOVEuYE44LJsApYjlHazZACQxGzm9l_wALyPjE&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a7a6bddf868d889cd2657e81a8b835d738f41d6181ea6a01826e3d774587efc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 08:02:11 GMT
x-content-type-options: nosniff
age: 289115
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59857
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 08:17:02 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 07 Oct 2023 08:02:11 GMT

GET
H2 200 shopping
encrypted-tbn1.gstatic.com/ Frame 7291 30 KB
31 KB 149ms
44ms Image
image/jpeg 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn1.gstatic.com/shopping?q=tbn:ANd9GcScU_cYuWlP2EDdljK-mqiuK8VMRXjwpGqdigJFWhPCfdAnY3QDP6cRqOB8cg&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43907ee1364a86effd6ba4dd012b658ab655b23490801b4219997c7754004157

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sat, 08 Oct 2022 14:09:41 GMT
x-content-type-options: nosniff
age: 180665
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31227
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 07:04:08 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sun, 08 Oct 2023 14:09:41 GMT

GET
H2 200 shopping
encrypted-tbn2.gstatic.com/ Frame 7291 21 KB
21 KB 162ms
72ms Image
image/png 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcQ6VFXeHyJ7gvSjPrO9WKPRNfvOFgfjrDZNailwVxjT2HR8xkt6&usqp=CAI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

13445ee05df55dc76c54059d73ae5077c4d08a7fd52c8dcb68e55b5b26ff2c78

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 20:40:46 GMT
x-content-type-options: nosniff
age: 243600
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21587
x-xss-protection: 0
last-modified: Wed, 10 Jul 2019 07:52:36 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 07 Oct 2023 20:40:46 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 55D4 4 KB
724 B 48ms
47ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3f714f28225e03c64ce6cd24eb1f076426d54a0c7bdadd813b590013008b9f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 15:14:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/ Frame F1CF 2 KB
890 B 49ms
44ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e949ac1ae6ecdbf35303e23db70feccc87409342b0ea83702febe7fb76d6009

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 110062
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 860
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
cross-origin-resource-policy: cross-origin
date: Sun, 09 Oct 2022 09:46:24 GMT
expires: Mon, 09 Oct 2023 09:46:24 GMT
last-modified: Mon, 21 Mar 2022 06:48:14 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3

200

B27436810.331495293;dc_pre=CLiq7dWI1voCFSqI_QcdbOQLQQ;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= Show response
ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/ Frame 7BC4
Redirect Chain

https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B27436810.331495293;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfu...
https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B27436810.331495293;dc_pre=CLiq7dWI1voCFSqI_QcdbOQLQQ;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag...

42 B
63 B

120ms
56ms

Fetch
image/gif

142.250.186.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B27436810.331495293;dc_pre=CLiq7dWI1voCFSqI_QcdbOQLQQ;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=7595713592&adk=560872816&adf=928226804&pi=t.ma~as.7595713592&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844411&bpp=2&bdt=406&idt=293&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=b63G1Phiaj&p=https%3A//plusonbr.com&dtd=296

Protocol

Server

142.250.186.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f6.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:46 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ad.doubleclick.net/ddm/trackimp/N463808.3493422GOOGLE-GDN/B27436810.331495293;dc_pre=CLiq7dWI1voCFSqI_QcdbOQLQQ;dc_trk_aid=523442556;dc_trk_cid=168185882;ord=2740941558;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=?
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
follow-only-when-prerender-shown: 1
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7BC4 0
0 85ms
85ms Fetch
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cesb-XEZEY72OONjL1fAP2IyQoAKCjP3DbLOd26zJD9vZHhABIMvX4XVgleKQgqAHoAH0uL_FA8gBCagDAcgDSKoE5gJP0EcxFWxeO_hs4vOoxozCfYDFe0KeBMlB1Is8idIhHSMRum2Pvj2YDq7HdAv4TZOFEcsL6nV9PYNEs53Lb5o8VP1ggEfHlJBxO3-AYdend1to3_oGO0PbBpKycdANBBqOuc_QKg9yCbQKsyJzt2dUQAzoRxDU0e01SFWFt2tX8oTD3d4tNcKYf2kp_dRxyAEppU-sg-6EjLez-BmM5LegFCcB4zuJ_hSTHmWAkTCBdVN2FD-HSFPv-QDmvPNAi7jMHYqqIva0WQzYg5tBx3wVgt77H1HN3z8ieSo4begHN8ixJg4iuSBqf-vAIIUGfOrCRb6ql4PI362VeN978toUxmx0HOJDTzZXbDenC0vlSXv10CtJMUpwKcxXV1ZNS3b67fFzHSyw1WZMAZITWmjQrGV4KhHdhci6rXMusRY4xgrXuHu8m1jvg3LSmPBDkEm9tu7B5o_YkHrT5pVlh9aZ6llf-s2YwATwmfjojASSBQQIBBgBkgUECAUYBKAGLoAH7KGopgGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBD7tRLSCBEIgOGAEBABGB8yAqoCOgKAQIAKAcgLAdgTDdAVAYAXAbIXHAoaCAASFHB1Yi0zNTM2Nzc5MzI5NzY3NTU3GAA&sigh=nmiN4T-Qyi8&uach_m=[UACH]&template_id=419

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=7595713592&adk=560872816&adf=928226804&pi=t.ma~as.7595713592&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844411&bpp=2&bdt=406&idt=293&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=b63G1Phiaj&p=https%3A//plusonbr.com&dtd=296
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 16:20:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame 7BC4 23 KB
9 KB 49ms
45ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 7BC4 3 KB
1 KB 73ms
69ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 7BC4 17 KB
7 KB 55ms
51ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 327
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:19 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7BC4 142 KB
44 KB 50ms
47ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 6994 13 KB
13 KB 165ms
78ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 19:26:22 GMT
x-content-type-options: nosniff
age: 420864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 19:26:22 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 6994 13 KB
13 KB 126ms
40ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 18:50:20 GMT
x-content-type-options: nosniff
age: 250226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12924
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:02:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Oct 2023 18:50:20 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 55D4 13 KB
13 KB 169ms
87ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 19:26:22 GMT
x-content-type-options: nosniff
age: 420864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 05 Oct 2023 19:26:22 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 55D4 13 KB
13 KB 129ms
48ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 18:50:20 GMT
x-content-type-options: nosniff
age: 250226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12924
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:02:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Oct 2023 18:50:20 GMT

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame F1CF 6 KB
3 KB 50ms
48ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 09:40:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23991
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2551
x-xss-protection: 0
server: cafe
etag: 4618035238173732404
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 11 Oct 2022 09:40:55 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame F1CF 34 KB
13 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c54c9898aae48b1324bda1eef59a2ad3193b74e86b97a8b53234f0e59b6faf5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 09:40:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23991
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13016
x-xss-protection: 0
server: cafe
etag: 4622897291624286229
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Tue, 11 Oct 2022 09:40:55 GMT

GET
H3 200 lottie_light.min.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/ Frame F1CF 147 KB
41 KB 51ms
50ms Script
application/x-javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/lottie_light.min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b989ef6e53e278a56abb90201c504c90c1b447f7e71eb35557e0e66b8de0a431

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 03 Oct 2022 22:27:01 GMT
age: 582825
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41971
x-xss-protection: 0
last-modified: Mon, 21 Mar 2022 06:48:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Oct 2023 22:27:01 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 79A7 143 B
166 B 38ms
37ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=7595713592&adk=560872816&adf=928226804&pi=t.ma~as.7595713592&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844411&bpp=2&bdt=406&idt=293&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C876x280&nras=1&correlator=3785730584727&frm=20&pv=1&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=884&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=b63G1Phiaj&p=https%3A//plusonbr.com&dtd=296
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 324
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:15:22 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7BC4 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8e5065241406728fdcff080061eb1abce2a3752c7f4bade122a09932b862f76

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 7291 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ff4055ce4f86b1ae5ca6d055ffb4a5c5740d7a13d52cba00cbd9ea62a7b3f905

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 data.json Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/ Frame F1CF 90 KB
20 KB 117ms
39ms XHR
application/json 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/data.json

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18240062200895701296/lottie_light.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78dfc6b617a12af75ac475876f0e98758e6fd7ec8d75bbe2d4b0eef7c86b8118

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 10 Oct 2022 03:15:24 GMT
age: 47122
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20843
x-xss-protection: 0
last-modified: Mon, 21 Mar 2022 06:48:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 10 Oct 2023 03:15:24 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 79A7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
18 B

67ms
66ms

Document
text/html

2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:46 GMT
expires: Mon, 10 Oct 2022 16:20:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:46 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2
fonts.gstatic.com/s/googlesansdisplay/v21/ Frame 7291 20 KB
20 KB 117ms
39ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesansdisplay/v21/ea8FacM9Wef3EJPWRrHjgE4B6CnlZxHVDv79oQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 22:12:48 GMT
x-content-type-options: nosniff
age: 497278
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20784
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:21:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 04 Oct 2023 22:12:48 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/ 151 KB
54 KB 215ms
215ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202209290101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f46e37b584ae2edf048cc30c5dace7870b64299a720da8235f2ebbeeedbfa341

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55042
x-xss-protection: 0
server: cafe
etag: 13242690916398442696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 -Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js Show response
pagead2.googlesyndication.com/bg/ Frame F1CF 36 KB
16 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 19:50:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15918
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Oct 2023 19:50:19 GMT

GET
DATA 200
OK truncated
/ Frame F1CF 16 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6eb68a84d74a46c8f0f3a4449b2b0449c6080a2dd8723c04be1bd41300f495f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H3 200 -Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js Show response
pagead2.googlesyndication.com/bg/ Frame 9A88 36 KB
16 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 19:50:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15918
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Oct 2023 19:50:19 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 128ms
48ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=plusonbr.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 126ms
48ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=plusonbr.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/ Frame 40E6 10 KB
4 KB 39ms
39ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 50834
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 02:13:32 GMT
etag: 9671129459699598864
expires: Mon, 24 Oct 2022 02:13:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/ Frame 1C7E 10 KB
4 KB 38ms
38ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 50834
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4420
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 02:13:32 GMT
etag: 9671129459699598864
expires: Mon, 24 Oct 2022 02:13:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css2
fonts.googleapis.com/ Frame 40E6 4 KB
636 B 128ms
49ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 16:06:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 40E6 205 B
229 B 122ms
44ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:32:09 GMT
x-content-type-options: nosniff
age: 2917
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 10 Oct 2023 15:32:09 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 40E6 604 B
628 B 122ms
44ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:31:39 GMT
x-content-type-options: nosniff
age: 2947
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 10 Oct 2023 15:31:39 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/elements/html/ Frame 40E6 19 KB
8 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6efff8ce63d77eba89e9cc15af6dbccc657068130e89225fc662a0c580cea9b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 15:55:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1509
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8224
x-xss-protection: 0
server: cafe
etag: 17584738254627026664
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 15:55:37 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1C7E 3 KB
601 B 120ms
50ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%20Display%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

fb7989597f1a10a56bd83de6a26eefec44a0c704979fb5e06f02195bc9cebfce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 16:19:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 1C7E 2 KB
902 B 39ms
38ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:55 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame 1C7E 23 KB
9 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 1C7E 3 KB
1 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 1C7E 17 KB
7 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 327
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:19 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1C7E 142 KB
44 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 ff28bd887d5918000d85a256eb9567a4.js Show response
www.gstatic.com/mysidia/ Frame 1C7E 32 KB
13 KB 104ms
40ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff28bd887d5918000d85a256eb9567a4.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a61fe6e2743a18f977ac18a2f805735e8dccf115b16dbbbd2e3864ae98d4c33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 10:33:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 452863
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13740
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 21:54:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 03 Jan 2023 10:33:03 GMT

GET
H3 200 shopping
encrypted-tbn2.gstatic.com/ Frame 1C7E 30 KB
30 KB 110ms
37ms Image
image/jpeg 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn2.gstatic.com/shopping?q=tbn:ANd9GcScPQ4P9EJYK9lp8T9edG5P0BHMVaWsHQxgeBBGOYCda7Rtc_OF5KLZnHgGZvc&usqp=CAI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

71d7d2e3c1065545f7577417d11f5f81584ac377a36fcfbad38265e2257e9dd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 11:41:40 GMT
x-content-type-options: nosniff
age: 275946
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30728
x-xss-protection: 0
last-modified: Wed, 28 Sep 2022 22:05:03 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/jpeg
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Sat, 07 Oct 2023 11:41:40 GMT

GET
H3 200 shopping
encrypted-tbn3.gstatic.com/ Frame 1C7E 5 KB
5 KB 115ms
39ms Image
image/png 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://encrypted-tbn3.gstatic.com/shopping?q=tbn:ANd9GcQvpTYpQZlRIahtahgcAzJ2H1153XgcaX2UFX8HmG-XEn0TlnrZ&usqp=CAI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d1cb6afd5c7d4161b719b1b73ab16564f145e713e90287ea0f72cef534cd8fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Tue, 04 Oct 2022 11:52:17 GMT
x-content-type-options: nosniff
age: 534509
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4742
x-xss-protection: 0
last-modified: Wed, 29 Aug 2018 18:40:18 GMT
server: sffe
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
expires: Wed, 04 Oct 2023 11:52:17 GMT

GET
DATA 200
OK truncated
/ Frame 1C7E 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 368fd24ebc03f7bd1eb0f17bb6dff6d5cd56cf6acb0c84768e64bbbf089e3477

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 de17d2874496eb5aa5ae962212bd52f2.js Show response
www.gstatic.com/mysidia/ Frame 54E4 10 KB
4 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/de17d2874496eb5aa5ae962212bd52f2.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0658601ec218af17ef062c0a57a3fb492033a478223a053975eeae25f87e275

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Thu, 06 Oct 2022 09:35:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 369898
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4282
x-xss-protection: 0
last-modified: Tue, 04 Oct 2022 19:51:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 04 Jan 2023 09:35:48 GMT

GET
H3 200 7a031a4bd3d80ce5a4fae4378d507105.js Show response
www.gstatic.com/mysidia/ Frame 54E4 150 KB
56 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a031a4bd3d80ce5a4fae4378d507105.js?tag=gpa/dynamic_fig_web_banner_v2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08314bb17bac3f5fdc87b1897aacc2fed33c2acfed424d31d0b69e45751cefa1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Fri, 07 Oct 2022 06:42:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 293877
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57114
x-xss-protection: 0
last-modified: Tue, 04 Oct 2022 19:51:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 05 Jan 2023 06:42:49 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 54E4 4 KB
816 B 51ms
50ms Stylesheet
text/css 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

44f07f8c8a8443be7f8461bcfeb542cdf4e4981e23754e37cc9029c5178fa36c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 10 Oct 2022 14:21:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 54E4 2 KB
902 B 40ms
39ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 875
x-xss-protection: 0
server: cafe
etag: 16974406330603315520
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:55 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/ Frame 54E4 23 KB
9 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9540
x-xss-protection: 0
server: cafe
etag: 6580860447119072478
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 54E4 3 KB
1 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 329
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/ Frame 54E4 17 KB
7 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221003/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 327
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7528
x-xss-protection: 0
server: cafe
etag: 13775775994264215463
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 24 Oct 2022 16:15:19 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 54E4 142 KB
44 KB 63ms
62ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45072
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1664970042070988"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 16:20:46 GMT

GET
H3 200 ff28bd887d5918000d85a256eb9567a4.js Show response
www.gstatic.com/mysidia/ Frame 54E4 32 KB
13 KB 80ms
80ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ff28bd887d5918000d85a256eb9567a4.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9a61fe6e2743a18f977ac18a2f805735e8dccf115b16dbbbd2e3864ae98d4c33

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Wed, 05 Oct 2022 10:33:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 452863
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13740
x-xss-protection: 0
last-modified: Fri, 30 Sep 2022 21:54:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 03 Jan 2023 10:33:03 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 1C7E 0
17 B 83ms
82ms Image
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C2G4FXEZEY7f5N8_H1fAPnfihyA6GjdnMa4i8hPfOEKTkg4iDMRABII6gpXFgleKQgqAHoAGOiP3gAsgBBqgDAcgDAqoE5wJP0DoKtTGL4fDmtilMcKDxJUK-qwK9UrcfUSL3owrbxYxul7wXKRvH_mkPslhiEoruBGX9D0DIhHzt08ADSVYAE6t4D0hEWPrc-W7ZHwmNA_ZiA_qABrmvYSns0nEJFgkG1PDgBKKvMS-nwI_3h7C0OonZZWm1NhVaZIgZnyw4ikdZkpUrVP2gqM9v0mY5IeXcmRawXpEHwhvcnmfdSaFJn-rvFOScfbeALARJLxEdeCd_sJ7Ms1NtXNjfKdrzGgoVBlhGysgE7QeSX47XvbeLlplScDfFp2wubz5CIhXfhJzqVGTeF6gvDbqTIL96f8jmkYzVsMHeZxXvs62Bff9V4QdI3VWP2_XpvedkU1jC5gCiJ0pROIoia4xIIjGSCn409o8zQhoUAPmeBLsEXzImEsDHLgkQelOvkU5FCZTJScchxEl9qWuIGHKUjJBF1FqIX4bZQiXSjKvb2gN4Ug9XfPkikAwpNsAEl6j6oPcDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBjeAB-PKxKIBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgHpr4b2AcB8gcEEIPwCdIIEQiA4YAQEAEYHzICqgI6AoBAgAoByAsB2BML0BUBgBcBshccChoIABIUcHViLTY2NTExODkxOTk0Nzk0NjYYAA&sigh=EQCn2eXEqw8&uach_m=[UACH]&template_id=493&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Mon, 10 Oct 2022 16:20:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

POST
H2 204 csi
csi.gstatic.com/ Frame 54E4 0
327 B 353ms
113ms Ping
image/gif 2607:f8b0:4001:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~l92zdqk6&c=8397980813780&slotId=4198990406890&qqid=CLaXndWI1voCFc9jFQgdHXwI6Q&sei=44729911%2C44730425%2C44730426%2C44752538%2C75259414%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=ssc&ulv=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/7a031a4bd3d80ce5a4fae4378d507105.js?tag=gpa/dynamic_fig_web_banner_v2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4001:c06::5e Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

14005133618456074320
tpc.googlesyndication.com/simgad/ Frame 54E4
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKCXsMjb_gEQ3AYYwgMyCJoYbogAFYW3
https://tpc.googlesyndication.com/simgad/14005133618456074320

81 KB
81 KB

40ms
39ms

Image
image/png

2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14005133618456074320

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dd4382e79b727cdc888bdfef1199b74f5b651781e957c8550d5dd4f7e1e5aaa4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sat, 08 Oct 2022 14:15:14 GMT
x-content-type-options: nosniff
age: 180332
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 82631
x-xss-protection: 0
last-modified: Tue, 10 Dec 2019 17:21:08 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 08 Oct 2023 14:15:14 GMT

Redirect headers

date: Mon, 10 Oct 2022 06:38:11 GMT
x-content-type-options: nosniff
server: cafe
age: 34955
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/14005133618456074320
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 09 Nov 2022 06:38:11 GMT

GET
H3

206

videoplayback
r4---sn-5hnekn7s.gvt1.com/ Frame 54E4
Redirect Chain

https://redirector.gvt1.com/videoplayback?id=94a06898a4b786b0&itag=18&source=web_video_ads&requiressl=yes&cmo=secure_transport=yes&ip=0.0.0.0&ipbits=0&expire=1665426046&sparams=ip,ipbits,expire,id,...
https://r4---sn-5hnekn7s.gvt1.com/videoplayback?id=94a06898a4b786b0&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1665426046&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,m...

1 MB
1 MB

69ms
14ms

Media
video/mp4

2a00:1450:400e:4e::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-5hnekn7s.gvt1.com/videoplayback?id=94a06898a4b786b0&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1665426046&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=0141379BED10E9F3EADD759D046112DF9C2D2D8B.22E2852F39CDA3098974D3954E92804FE9B476C2&key=cms1&cms_redirect=yes&mh=tM&mip=2a03:1b20:6:f011::2e&mm=28&mn=sn-5hnekn7s&ms=nvh&mt=1665417699&mv=u&mvi=4&pl=48

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

2a00:1450:400e:4e::9 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

a82e7f246d0d5edd31074a4a19bbaa7431ed16b2d26102ce67b6869f62f642d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

client-protocol: quic
date: Mon, 10 Oct 2022 16:20:47 GMT
x-content-type-options: nosniff
last-modified: Sat, 10 Sep 2022 23:11:36 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
Content-Range: bytes 0-1523025/1523026
cache-control: private, max-age=6899
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 1523026
expires: Mon, 10 Oct 2022 16:20:47 GMT

Redirect headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:47 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r4---sn-5hnekn7s.gvt1.com/videoplayback?id=94a06898a4b786b0&itag=18&source=web_video_ads&requiressl=yes&ip=0.0.0.0&ipbits=0&expire=1665426046&sparams=expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,requiressl,source&signature=0141379BED10E9F3EADD759D046112DF9C2D2D8B.22E2852F39CDA3098974D3954E92804FE9B476C2&key=cms1&cms_redirect=yes&mh=tM&mip=2a03:1b20:6:f011::2e&mm=28&mn=sn-5hnekn7s&ms=nvh&mt=1665417699&mv=u&mvi=4&pl=48
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 707
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame BD40 42 B
64 B 143ms
71ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvCYnXwuiZgSxaIoWlY5rL6smvs6RuLm8dDJmvufsDt7FVG89cnykjhTjBkDIo0Ed6EYPg8MIVVKMF2GV6krnjnMKs&sig=Cg0ArKJSzDMuwPb2rrCbEAE&id=lidar2&mcvt=1000&p=0,0,280,876&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20221005&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3554060845&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665418844697&rpt=1254&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 55D4 0
127 B 15ms
15ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Mon, 10 Oct 2022 16:20:46 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 55ms
55ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20221003&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ecd0cd510c8d37acd9f9c0014a9fff7f1c0d37f4d903014c8752f7740d6e5bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11332
x-xss-protection: 0

GET
H3 200 -Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js Show response
pagead2.googlesyndication.com/bg/ Frame A403 36 KB
16 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221003/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 19:50:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73828
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15918
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Oct 2023 19:50:19 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 10 Oct 2022 16:20:47 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7BC4 42 B
64 B 72ms
72ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv76mWKMPbShlDT2Oplqq8zTZWybvlpZzfUqLUwJ6g4PWpEej8-r6sKF-mSG33Xi5CHMzWTZNPJzC_DN3epAMK8Uc1olZtOMuBN2TAsH0EW-yShOq7hcivrzxQM_jiHnGsfrlRJPQ&sai=AMfl-YRr39Y1z3TRH4ws-awmk-NDnADKTMwxMmm44BVGEgg0a9_YKaG0STfIeYa8nDW9wb87Y8yJeN7ZODi9hPw&sig=Cg0ArKJSzGCiK7uu2s_PEAE&id=lidar2&mcvt=1016&p=0,0,225.78125,876&mtos=1016,1016,1016,1016,1016&tos=1016,0,0,0,0&v=20221005&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=2&adk=560872816&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665418846107&rpt=155&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3CBF 13 KB
5 KB 40ms
39ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2319
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 15:42:08 GMT
expires: Tue, 10 Oct 2023 15:42:08 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 62D8 783 B
536 B 130ms
50ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

63209f50bb9593d33f5f5ed00c65d354cd88023393d8baf5cb9cbfb612d304a6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-k_fk1VzWamyOHmTHq6-X3g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-k_fk1VzWamyOHmTHq6-X3g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 10 Oct 2022 16:20:47 GMT
expires: Mon, 10 Oct 2022 16:20:47 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 -Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js Show response
pagead2.googlesyndication.com/bg/ Frame 3CBF 36 KB
16 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/-Y38d37a1DmvdXzRnIUkD6jTpQ2urOaWudC6FG_jR1g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Sun, 09 Oct 2022 19:50:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73828
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15918
x-xss-protection: 0
last-modified: Tue, 27 Sep 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 09 Oct 2023 19:50:19 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 62D8 0
0 70ms
70ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20221003&jk=3977832846939032&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3CBF 0
11 B 38ms
37ms Image
text/plain 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?KFMA4A
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date: Mon, 10 Oct 2022 16:20:47 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1C7E 42 B
64 B 73ms
72ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu8FOYvr7S_tVRM92Ga4TAlpWDORLEjiabpqRDLCD7i0usAqcnA_YJ_uI-RorOTRtX6bj2rjXVTAC_M55MFdkbAIgQx_v1F4Yv_9W-6SsQPi9jsSEYds9eoaMUjbHlba-ssBEhtVA&sai=AMfl-YT6TNo4luqERSf4iay7-FpQT6_e23okRinPzdpTMz_RoIO40fu1nHNC0WBqt_7LoZe-QX2tLpSJ8cDfGSE&sig=Cg0ArKJSzCEfnGdmcvhcEAE&id=lidar2&mcvt=1000&p=0,0,124,1005&mtos=83,700,1000,1116,1188&tos=83,617,300,116,72&v=20221005&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1665418846617&rpt=203&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 73ms
73ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20221003&jk=3977832846939032&bg=!dHeldzPNAAYQgTJdMIE7ACkAdvg8Wib--siOAR6_7uaFLdILT-5DM1XLFEW6si_8o1GhRk-zheGoVgIAAABrUgAAAAFoAQcKAKCUxTwq7dZJf7k4zbNYfXGlB_PjKYLJeiNAcwtAFvRVnSFMIAuLko-Y1yWdMQk6lKxMU4uhCH4yKvOLi1Rt_GQ4q_xo9eBnIYZub0Gkq0iuv28EHz-33zxxItJhasIGSZuGSLjbUqufncAIGlStPRUjfrdYNC_98Z-pqyGEWwoVBU89XK3Ot2WMZ3mAjrZ4zRF0rRGVSEs_k0IvhntUc6vpmQLlRJSGD-EtFS3wQUp3uMjn2IIV4N2hu-yOep1eCYiHihO72GX7QV-JE7IbnNKNY-Jktto8hQaKftb0pUCAGeXTIEeC8oRyLgO_K4zrw03_6fne_htXTPP56BE_gKvq0Cl_sY1KUsYJuh-e1X1DeFnZ10hAmtD7ogWxr01ixytgnDrAWhbqkDFcIJgpIDs-T_TzsVffMpyplrQdMHV8MSt1RaPiyLwy_XqiXh_4HA3NZIea1jDO1TkPL2TMRsB29bwPoi6dhBf7_7xniCtB0wbtHa4POL2wWW5NiwBEfOwz2cQ3v33waiiJyuHzSkQRbhZpnPSCFSdCSo7qNG8HR_DSu7_2q4phVdhezqO_euwkEvXB_-8yABoOD1fYbIlC79nKqvqq5AHZi2TJqDnwkucehw1ZdclUz-Eo8WtYobhpP0k7VUbDny45SzhpfMlxrl-OWqx0MOkwgh6ckCXYMFCOP7ZqE0BFuzsFI--DjIUqA3J2DYXLvc7c7qxbMKHWiWMXdta3LRVRjHhEnOPX18BzsFQqAzj7b30-_sL6eR6Jo62S-NZqEwN1UWHbOmZhJ2pngeI9ANabYg-38NMORoWWF5JOtk3cVbLf-hm-3Y1IVCMqrrr9xvQVwijrTsYf2WKNvE4782J0VqArvHfWn-IQua3PPEm7FH2ux7t3GGa-QeQimRtQucstmFot96mUTIv4rX59epOsrAYVB__iPz0d6w30bnXjs7czWf4N41y-22P4RMbHdJa44XONoHEHqT4KAi54OagE-lS3S5hst4uPRfBj9yIicE8OxSDMpZ3IpEAKcI8PO9YmfQss2x7-hmBOAwK2SSSXnStKbyXKuOqutF-WU50ebIVrU50qwjcqKH97XA-rG6kvKiu9q73p6EvnmvRIvDRaSeQGEjFDYnn8KXNzkFe2AHTveqal-5-QFzxUDhp7A_c99Yh9jClQzXVEs2vRIAT7_i4pKwkg5vPlts0eDMJB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

POST
H3 204 csi
csi.gstatic.com/ Frame 54E4 0
17 B 341ms
114ms Ping
image/gif 2607:f8b0:4001:c06::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~l92zdqke&c=8397980813780&slotId=4198990406890&qqid=CLaXndWI1voCFc9jFQgdHXwI6Q&umsem=0&ple=1&ape=1
Requested by: Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/7a031a4bd3d80ce5a4fae4378d507105.js?tag=gpa/dynamic_fig_web_banner_v2
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4001:c06::5e Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 10 Oct 2022 16:20:48 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/plusonbr/css/bootstrap.min.css

Verdicts & Comments Add Verdict or Comment

80 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
plusonbr.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: rnn3ahsnfeovb000dn6evn0vn9
.plusonbr.com/	1970-01-20 16:12:58	Name: _ga Value: GA1.2.146803945.1665418845
.plusonbr.com/	1970-01-20 06:38:25	Name: _gid Value: GA1.2.1998835640.1665418845
.plusonbr.com/	1970-01-20 06:36:58	Name: _gat_gtag_UA_216073346_1 Value: 1
.plusonbr.com/	1970-01-20 15:58:34	Name: __gads Value: ID=37444bcb6954588e-228113b140ce006f:T=1665418844:RT=1665418844:S=ALNI_MZY2mnNqcgoRsVXTccEe8T38WGkYA
.doubleclick.net/	1970-01-20 15:58:34	Name: IDE Value: AHWqTUn5BRtW5VACvZlyGejPpZLa1rADGKWDJWrkMuJrlee5v1YP1s2Q_KDX5CFBfLY
.doubleclick.net/	1970-01-20 06:37:02	Name: DSID Value: NO_DATA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://plusonbr.com/emprestimo/emprestimo-pessoal/emprestimo-caixa-saiba-como-contratar/?utm_source=ActiveCampaign&utm_medium=email&utm_content=E-mail+Importante%21&utm_campaign=Empr%C3%A9stimo+174+-+Atividades+Recentes+-+Pedro&vgo_ee=XogMbjT%2Fp%2BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%3D Message: Refused to apply style from 'https://plusonbr.com/wp-content/themes/plusonbr/css/bootstrap.min.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
other	warning	URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3536779329767557&output=html&h=280&slotname=1213288011&adk=3554060845&adf=1797312767&pi=t.ma~as.1213288011&w=876&fwrn=4&fwrnh=100&lmt=1665418844&rafmt=1&psa=0&format=876x280&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Femprestimo-pessoal%2Femprestimo-caixa-saiba-como-contratar%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3DE-mail%2BImportante%2521%26utm_campaign%3DEmpr%25C3%25A9stimo%2B174%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DXogMbjT%252Fp%252BHqHSUr8UX03qyPUFd7JHyq9acdSgULWaM%253D&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1665418844407&bpp=4&bdt=402&idt=283&shv=r20221003&mjsv=m202209290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3785730584727&frm=20&pv=2&ga_vid=146803945.1665418845&ga_sid=1665418845&ga_hid=256536801&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=208&ady=484&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44774649%2C31070198%2C42531706%2C44774653&oid=2&pvsid=3977832846939032&tmod=1171858834&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=21Ds0znGH5&p=https%3A//plusonbr.com&dtd=288 Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
ads.eu.criteo.com
adservice.google.com
adservice.google.de
cat.nl.eu.criteo.com
cdnjs.cloudflare.com
csi.gstatic.com
csm.eu.criteo.net
encrypted-tbn0.gstatic.com
encrypted-tbn1.gstatic.com
encrypted-tbn2.gstatic.com
encrypted-tbn3.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
plusonbr.com
plusonbroficial.lt.acemlna.com
portalonbr.com
r4---sn-5hnekn7s.gvt1.com
redirector.gvt1.com
rtb.fr.eu.criteo.com
rtb.nl.eu.criteo.com
static.criteo.net
tpc.googlesyndication.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
plusonbr.com
142.250.186.166
178.250.0.139
178.250.0.162
178.250.2.148
23.23.66.23
2606:4700::6811:190e
2607:f8b0:4001:c06::5e
2a00:1450:4001:808::2001
2a00:1450:4001:808::200e
2a00:1450:4001:80e::200e
2a00:1450:4001:813::2002
2a00:1450:4001:827::2002
2a00:1450:4001:829::2002
2a00:1450:4001:829::200a
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2002
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
2a00:1450:4001:831::2003
2a00:1450:4001:831::2004
2a00:1450:4001:831::2008
2a00:1450:4001:831::200e
2a00:1450:400e:4e::9
2a02:2638:1::2
2a02:2638:1::3
2a02:2638:1::4
2a02:2638::2
2a06:98c1:3120::3
2a06:98c1:3121::3
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
08314bb17bac3f5fdc87b1897aacc2fed33c2acfed424d31d0b69e45751cefa1
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0c54c9898aae48b1324bda1eef59a2ad3193b74e86b97a8b53234f0e59b6faf5
0d8c3cc19e9958f985a4c5ae2d0f098706cf42b259e6e0a40fae39434dbc3e32
0eae38a44ef9db61dcf9781fc876cd43d32e28640dd2e69caf1085d44bb4a095
11897f9c64bbd6118277253f82a0ce4e6679fe2db704ddd8821f304f7df5de6c
13445ee05df55dc76c54059d73ae5077c4d08a7fd52c8dcb68e55b5b26ff2c78
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1bff94fc53b0367730ae0231d3ac6897ca493f98652f95613d5a2ee94d71eadb
20d25490828875caa4383cfa086c7efd6e0abdb4f482078a3abed65ee7cac965
21d050f59058aaa9dca7fd9afb374aabe8c21125febad6d7d7239fc21b2cae73
2ec41b7caaa3188dd4dae26cb4642386f6f602f75e828ef2cd57ede98d9892e5
361b799e6c913489b31748cf8475527e7f0de5052a86d4808901da32182f1d27
368fd24ebc03f7bd1eb0f17bb6dff6d5cd56cf6acb0c84768e64bbbf089e3477
40baed6f32e40e90913b6983441c9c3af9a1c2fd393693bf5a2e9f64b743d65a
43907ee1364a86effd6ba4dd012b658ab655b23490801b4219997c7754004157
44f07f8c8a8443be7f8461bcfeb542cdf4e4981e23754e37cc9029c5178fa36c
4bb8d34ce6536015de2e59677b929760357767d2964672a5bca5bbb25c7c9fe6
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
505186de1197eaf2e3d1c4dc2cd77e77549ea15d52b94d261f3029181e7e38ef
54d92a5c6b1f986c1514ce8249674a3dde39d2b665843551140f9e29bc015d79
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
582c2586c49819d9dfe5cb88653679a40bf930ca86f1dc01a4afd821a9eab97e
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5cdaf6aae2dabbdc998aa46fe673b49e901ec1810832273aeb47ae58e1e7b003
5e949ac1ae6ecdbf35303e23db70feccc87409342b0ea83702febe7fb76d6009
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
627475466ee35774e9f30511f127a579062d52edbf0e649da618d7dba95c861a
63209f50bb9593d33f5f5ed00c65d354cd88023393d8baf5cb9cbfb612d304a6
63d3f0bd5db6372e190e1fb8ee9819a257d3cdc392c1137ea2054e65d164751d
6491192e35a930b0fd7f7e3ce91d056dc582c53f7ba120daf66308d529075d3c
65ef5266036fa6fae953a70874220873bb6b7063ff7dc8039ca05d28b77434cd
65f4e452b96ef3e5e3a4631d99c63dd7239dcbcb88de679ac74ac30d3d4988cd
6b6390404934b4ad66937933ac9d4a605b5e8acbbbdbda8c3a9fa6e074577878
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6eb68a84d74a46c8f0f3a4449b2b0449c6080a2dd8723c04be1bd41300f495f9
6efff8ce63d77eba89e9cc15af6dbccc657068130e89225fc662a0c580cea9b7
6f4813e4fe6dd891838e421479bf603f6d3f0d2a55b90517b875a77050471d4b
71b5cbdbfcee0b19b5e47c6741c9360958ee4108ec3f89a5b56afdc0e1118395
71d7d2e3c1065545f7577417d11f5f81584ac377a36fcfbad38265e2257e9dd6
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
78dfc6b617a12af75ac475876f0e98758e6fd7ec8d75bbe2d4b0eef7c86b8118
7a2c6856e8437c3183ec517c59fc9724eb82cac59f685970113a7fb15ecd272c
7bc67b2d52b0a5c493421b99be51b76dd33a8f7a71b8f683ce836cfae44e0c9a
87d341106f6c056e7c4a0558d38f1ea50ebb7d3cf1fb9cb0bd1417aba2a07680
881aa40e19c2f5a971e46838651eacbe303d5d1f86a4c015b6d20fd707d55991
89e9d69772a59c9cd2bfc22b5cf63164124a2905c4cd38877637eab8d023a900
8a58d79d1433b460d45a481a87382b317345042eff066c0625f00fa9f561e63c
8a7a6bddf868d889cd2657e81a8b835d738f41d6181ea6a01826e3d774587efc
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8c126bc13a8986f1a9ac0cfd1cd67280a5ae0eca52d4519fe702b7cf85c76a43
8d1cb6afd5c7d4161b719b1b73ab16564f145e713e90287ea0f72cef534cd8fd
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
8ecd0cd510c8d37acd9f9c0014a9fff7f1c0d37f4d903014c8752f7740d6e5bf
8fb2f9f4c18d7e10bab89be6081bdbba389c34a7d7f10b5f90c805766b22906f
93eaf3820b1994575c05968a517e97557b3aa318ab184195aec06b4446122f99
97287fd3a406ce6bea920d6021e13bee0f5b56755e5150f0bfc95a1c3b5a953a
981c0bff12cb03203363a70e8ffe9b7fdf4af3b0b10c7a02a639eb13327574c0
9874f5642b434d93b208329bca413f7cf45382049fae420ead50829666718625
9a61fe6e2743a18f977ac18a2f805735e8dccf115b16dbbbd2e3864ae98d4c33
9baad53f219743e2e36c716ba90adba1990a9715d6efc18f3cb870cbfc8a33cb
9d33b9b60ad4b3d47a0a695ff8453951b970c9146a9498d5e0833a5723a972ae
9e3e02bb5848279882d86ee9acb89c42501bad923eee8342e191f58e30987d12
a008ec2c2e404617fa956991b5eaf0d1b50cf2728cadeece8e74d9e3dd399931
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a67069ae225c6ddecfa04ce2abd1694e6c3f886c214bdab1f3913d03ddeb1d7d
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a82e7f246d0d5edd31074a4a19bbaa7431ed16b2d26102ce67b6869f62f642d4
a8e5065241406728fdcff080061eb1abce2a3752c7f4bade122a09932b862f76
a981d1cf29a578baf94ef901db9a17e0f078f407d4133a806c465682ede97fc9
a9c9bead427bcdc4ece27146575b004e44566f105a07d4a931def635ae2b1f44
acc5497e76f832d950d14fcfa047dc3c864f7a0aae4c7a20521c0c655a53033b
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
b93a6ce124c9ca036cce77ee84dc26d578cb04610fec20dca1a0983aeceb73c4
b989ef6e53e278a56abb90201c504c90c1b447f7e71eb35557e0e66b8de0a431
b9a760bb7f2b48d3f293dcb65b77aa6404ca9c381bb581c0fe393282316fc336
b9b050bf255ed6f28b588a1ad88c328a7dd0baea698d11fa2eb09296c97bb9e2
ba29faf5efe544ed157bbf56aafd0555a22103b36514708d7fcd196fc361c2f5
bbd3e92ed859e9a02580195e28bb3414f12fb672eee769dc3d1e7b686b607ee4
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c0a100f5d8169a2a979d5a017b087b39173f51f2b4f63322715ed8c789b905ee
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205
c94e1e3f15da3b3acb696439f1d416428913fd41b65df297dced70c43c665799
cac39331fda1036b58d952e0ea6cc7acb5e9509b52b8f5a870cf0285e05609b8
ccaa0c13277452c5548a11750e8b67f62c0c7ceacf978b76a1905858543d76d0
cfb0cbf98ae7fa9420eb0a6fe7a23d383171e3c61fa3cc8c37c35bd61d0d8f69
d347720208b19529428789a7431ae2951d603c160bb0f865def7b9d0431ffa78
d393fee4858d73610ef9ac7d9b9788f75147371523b18dc66ed92e62e1cf4e5b
d5d283c43475751b50be2beddc94b041d094813f630b555bdc29d5565ecc44e8
d5fbe98d157dc691140d47dbf46f151800660611986144365cfc1606d7ad940f
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
dd4382e79b727cdc888bdfef1199b74f5b651781e957c8550d5dd4f7e1e5aaa4
e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d4518e77779f56120a95d2858574aefe5c1fb5f89bcf26bdd308e6869d3167
e3f714f28225e03c64ce6cd24eb1f076426d54a0c7bdadd813b590013008b9f1
e51db2c2c8969d3de4a96cd461d9739cdd14ece15dc2ae4ce8573bbc8986f3c1
e672f29f8e1e3b07e8a026f24d29924cf60203932c29f52cb1df9fae6b5aa66b
eb45c4a2484fd9cca288778c942f258c2185ec97445b4e5ddf8e2dbae6f481d1
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0658601ec218af17ef062c0a57a3fb492033a478223a053975eeae25f87e275
f0f453bafbbba6a39685a4ac97a1dc89773da2adadf8940763ff4ad70a4aba5b
f46e37b584ae2edf048cc30c5dace7870b64299a720da8235f2ebbeeedbfa341
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f7408c25067cd0a9d9fe835cb4c05e394a50751d3fcde0c461db19a309abb02a
f831d49514009bef4e365507bafda17a510bf08bbab99af7423d3a47fa8b742d
f98dfc777edad439af757cd19c85240fa8d3a50daeace696b9d0ba146fe34758
fb7989597f1a10a56bd83de6a26eefec44a0c704979fb5e06f02195bc9cebfce
ff4055ce4f86b1ae5ca6d055ffb4a5c5740d7a13d52cba00cbd9ea62a7b3f905

plusonbr.com Open in urlscan Pro 2a06:98c1:3121::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

173 Requests

98 %HTTPS

83 %IPv6

17 Domains

32 Subdomains

30 IPs

4 Countries

3727 kBTransfer

6498 kBSize

7 Cookies

1 Outgoing links

Page URL History

Redirected requests

173 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

plusonbr.com Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Screenshot
Live screenshot

Full Image

173
Requests

98 %
HTTPS

83 %
IPv6

17
Domains

32
Subdomains

30
IPs

4
Countries

3727 kB
Transfer

6498 kB
Size

7
Cookies

173 HTTP transactions
6 data transactions