wheregoes.com Open in urlscan Pro
2606:4700:3035::ac43:b70e Public Scan

Software

sffe /

Resource Hash

227fff75c4236d888dd7f5b7bdb52a1f7128ce90ca02e6e2b4c33a501ea4c89d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Mon, 08 Aug 2022 10:32:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 246476
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134395
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 08:39:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 08 Aug 2023 10:32:33 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 114 B
727 B 77ms
31ms XHR
application/json 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wheregoes.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a2a2dbe0fa48f1113ca9405fe31993bdfd0ff541fc001294545f37fb7c03aa6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 91
x-xss-protection: 0
expires: Thu, 11 Aug 2022 07:00:29 GMT

GET
H2 200 CEAIT5QE.json Show response
srv.buysellads.com/ads/ 934 B
670 B 87ms
27ms Fetch
application/json 178.128.255.150
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.buysellads.com/ads/CEAIT5QE.json?forcebanner=464041&ignoretargeting=yes
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.128.255.150 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-nl-11.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: ce784ad7eafb160ab2b81e13f3d2dc57c0a8c1361d5373c84258e517c960865f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 11 Aug 2022 07:00:29 GMT
content-encoding: gzip
server: //srv.buysellads.com
content-length: 557
vary: Accept-Encoding
content-type: application/json; charset=utf-8

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
937 B 79ms
31ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:29 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 237635
x-amz-request-id: txc6abd54ace594ae2a5b2f-00629f4bc7
x-amz-id-2: txc6abd54ace594ae2a5b2f-00629f4bc7
last-modified: Tue, 10 May 2022 09:57:32 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XX4GZnGVPy8JLXdm6r6wMvm6uEBlhmdKjeLJOC99C7EMRSgVoWaCdSGmdtpbBlPuo5aS2P2GE3rl%2BO6YqG3cp8yXy4JpqMoIs310rZsmzHQwNnRDmher8b9V8jUL8W807hNIuYqFU2Vui2F5"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1652176652152482
cf-ray: 738f183708b490c1-FRA

GET
H2 400 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
331 B 423ms
152ms XHR
text/html 54.146.39.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1660201229878&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&measurable=true&bids[0][bidId]=2433462e8517d&bids[0][config][property]=WhereGoes&bids[0][config][zone]=Wheregoes_S2S_Leaderboard_ATF_ROS&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[1][bidId]=3bb10793885936&bids[1][config][property]=WhereGoes&bids[1][config][zone]=Wheregoes_S2S_Sidebar_ROS_Pos1&bids[1][sizes][0][width]=300&bids[1][sizes][0][height]=250&bids[2][bidId]=4806da4f093863&bids[2][config][property]=WhereGoes&bids[2][config][zone]=Wheregoes_S2S_Leaderboard_InContent_BTF_ROS&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&bids[2][sizes][1][width]=300&bids[2][sizes][1][height]=250&bids[2][sizes][2][width]=336&bids[2][sizes][2][height]=280&bids[3][bidId]=5d7dfabd944d71&bids[3][config][property]=WhereGoes&bids[3][config][zone]=Wheregoes_S2S_Sticky_Sidebar_ROS_Pos2&bids[3][sizes][0][width]=300&bids[3][sizes][0][height]=250&bids[3][sizes][1][width]=120&bids[3][sizes][1][height]=600&bids[3][sizes][2][width]=160&bids[3][sizes][2][height]=600&bids[3][sizes][3][width]=300&bids[3][sizes][3][height]=600&property=WhereGoes&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.39.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-39-184.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5352720a5ffb778e42dbb1d4b81c975c02018dd660e1fe9c430cbf13dba78762

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:30 GMT
x-powered-by: Express
etag: W/"38-oN4RNSEETikJBvZER0pAAAEOHrw"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 93 B
743 B 180ms
124ms XHR
application/json 216.52.2.48
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.43.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: 01c8f1d09da5c1870548b3a84221dc1a2ce2fe54769a3a9835dcd612897016b7

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 11 Aug 2022 07:00:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 98

POST
H2 200 adreq Show response
ads.servenobid.com/ 755 B
709 B 486ms
249ms XHR
application/json 54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=6288
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: 6bfde5b839e39982ea64aee37f30c596b7424190f801ef459f2b2c6085d407bd

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 204 prebid Show response
mp.4dex.io/ 0
329 B 89ms
41ms XHR
text/plain 2606:4700::6812:372
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mp.4dex.io/prebid
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:372 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:29 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 738f18372eb3bb3e-FRA
x-err: Parsing the Prebid Request. ads.txt not fetchable or parsable
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
360 B 68ms
20ms XHR
application/json 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://wheregoes.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 21 KB
13 KB 247ms
200ms XHR
application/json 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

nginx/1.21.3 /

Resource Hash

7f4364968e82163b4af68b1f2c2030f14381f69a6bb029d7417aaf7fd4bc2129

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: dcf38f6d-9be5-4e0e-bc6f-43012a72a98e
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 357 B
705 B 541ms
326ms XHR
application/json 195.244.31.10
IGUANA-WORLDWIDE

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&PublisherDomain=https%3A%2F%2Fwheregoes.com

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

195.244.31.10 Newark, United States, ASN63140 (IGUANA-WORLDWIDE, US),

Reverse DNS

Software

ayl-lb-usa02 /

Resource Hash

f8ea816a727cfa75c77692ad70a2c177918bce8f800de5ebf9bdbd72528d5ba2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:30 GMT
x-content-type-options: nosniff
server: ayl-lb-usa02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 229
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 357
expires: 0

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 350 B
1 KB 250ms
122ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&tg_i.pbadslot=8691100%2FWheregoes_S2S_Leaderboard_ATF_ROS%23bsa-zone_1641228026595-4_123456&tk_flint=pbjs_lite_v4.43.0&x_source.tid=f25c3225-c6ee-41e5-a688-85125d560c73&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.46034307028074206
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 8b3c8607c39ed5e27daf88eb4cddbecc11d691be421c39488670c56a2ed2f9a9

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 350
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 328 B
1 KB 246ms
118ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&tg_i.pbadslot=8691100%2FWheregoes_S2S_Sidebar_ROS_Pos1%23bsa-zone_1641228120494-5_123456&tk_flint=pbjs_lite_v4.43.0&x_source.tid=dde7a5af-3a85-4bbc-9848-5d2a1001c76f&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7637752462273741
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: beb822d0ef039f291c379444a4b095387d7ceed757310afcd3bfcc872c9bc241

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 328
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 360 B
1 KB 262ms
134ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=2%2C16&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&tg_i.pbadslot=8691100%2FWheregoes_S2S_Leaderboard_InContent_BTF_ROS%23bsa-zone_1641318314037-7_123456&tk_flint=pbjs_lite_v4.43.0&x_source.tid=334c4337-9857-4eb2-a290-c892ba2dd7c4&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.4567491722738579
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 11470e3749e34a048a27712f9718699282d0ee3513a6b49e5c003ce0233d2e28

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 360
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 359 B
1 KB 271ms
144ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&tg_i.pbadslot=8691100%2FWheregoes_S2S_Sticky_Sidebar_ROS_Pos2%23bsa-zone_1641318529900-6_123456&tk_flint=pbjs_lite_v4.43.0&x_source.tid=b97362d5-25a4-42a3-866d-101d3a5a498b&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5593470597418677
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 081d18cea089e802a74e62b9f5cf5d11b2cd61569361f9c92844c372eb6e93f4

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 359
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 130ms
57ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=89497853756

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:28 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
291 B 441ms
167ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280a57d4001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 24996124ddddaf0a31183a8210d69b3528044765f86a46f64a261352dc9035de

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 448ms
175ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: f39e7bfca767f1ca185c54af245a9a79cc83c902095b10d546abfa1c8abf4738

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 451ms
178ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 3e64abdc86061b2780448fac3889b3c4eaf975cb49cc19e906a5231fb1946261

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 473ms
201ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: ab22895990ce764dab8911b410af480fff8ee6905b8c45e743dc33381308869c

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 449ms
177ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 60e4e7bf81d915f5f84808d7e87608e7a75fa2a4a690534c2400a277aa05ebcb

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 448ms
175ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280be73c001e&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 11b6bb02fbc8788f4683c3fdc5d48400918c1800fb8b82bc3f3a6969454d44cc

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 445ms
173ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 1c5bc909cafef7eb9927452e49959cb6aea161b110857e5222d5f690dd6a5ee4

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 473ms
201ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280c36f30017&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 6a0fe85bfbcc234c708182cc142d6e661bafd38f035c1538800042fdbe79eb8b

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 545ms
273ms XHR
application/json 52.4.33.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280cdbc80018&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.4.33.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-4-33-45.compute-1.amazonaws.com
Software: ATS/9.1.10.25 /
Resource Hash: 51937aced09afe64cf09132239dc6c7475572ab0c3f4bf50fad16cc14c390d5d

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
server: ATS/9.1.10.25
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
903 B 300ms
249ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 42aed428f44f456e598ea6f38dc0290ea803c28d93dbfff9d05a588882eaac8f

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
23 KB 97ms
54ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b55131eaef425cb84b957a28df5881c3c83eb11ca9c01e3abccb00baf0e377b6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1587158
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: tx6e74bfe3022248d3b6d59-0062b3893f
x-amz-id-2: tx6e74bfe3022248d3b6d59-0062b3893f
last-modified: Tue, 10 May 2022 09:57:31 GMT
server: cloudflare
etag: W/"2430496689c00115831347992a974246"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lxlhGGifNQ4%2FFxO57yvLGNiPbvxMYytP344zf8PkdKcbmfeahNLJ%2FFNKGHOQzqJYSe5TjqrURmC3bQ3OR7ww4lRdxp9pD7cbNZWWw8rdHCYZN7ruhUm5G9QGAIfhapBHs0kYV5VQzc0muwa%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1652176651393042
cf-ray: 738f18378fe29bda-FRA
access-control-allow-headers: Authorization

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 76ms
28ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 75ms
27ms Script
application/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 86 KB
15 KB 154ms
110ms XHR
text/plain 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1102085089393110&correlator=4089618612596141&output=ldjh&gdfp_req=1&vrg=2022080801&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Leaderboard_InContent_BTF_ROS%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%2C300x250%2C320x50%7C728x90%7C300x250%7C336x280%2C300x250%7C120x600%7C160x600%7C300x600&fluid=0%2C0%2Cheight%2C0&ifi=1&adks=1696759606%2C2861055222%2C3878002045%2C3809685794&sfv=1-0-38&fsapi=false&prev_scp=optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%26hb_size_appnexus%3D728x90%26hb_pb_appnexus%3D0.03%26hb_adid_appnexus%3D7830084a906f3ef%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D728x90%26hb_pb%3D0.03%26hb_creative%3D78827815%26hb_adid%3D7830084a906f3ef%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.03%7Coptimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%7Coptimize_ad_unit_id%3Dbsa-zone_1641318314037-7_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0%7Coptimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&sc=1&cookie_enabled=1&abxe=1&dt=1660201230457&lmt=1660201230&dlt=1660201228445&idt=1118&adxs=436%2C1091%2C276%2C1091&adys=474%2C666%2C1127%2C950&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&frm=20&vis=1&psz=1182x1412%7C300x952%7C862x1020%7C300x952&msz=1182x90%7C300x250%7C862x250%7C300x600&fws=516%2C0%2C0%2C0&ohw=1182%2C0%2C0%2C0&ga_vid=2136585878.1660201230&ga_sid=1660201230&ga_hid=809709769&ga_fc=false

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

358a6379f78d8cd00fbcfb840b14077960d835169ae067006770f49025050a6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15582
x-xss-protection: 0
google-lineitem-id: 5651215829,5320060794,5320060794,5320060794
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138344350510,138305848162,138305491763,138305458998
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 84ms
38ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022080801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bee8f357628c8cb08df1049a2fa67b13f5e17f8edbb4dbcaa9f3e2fe9f79f65a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11104
x-xss-protection: 0

GET
H2 200 container.html Show response
b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame ED2B 6 KB
4 KB 125ms
65ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:30 GMT
expires: Fri, 11 Aug 2023 07:00:30 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 138ms
55ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 07:00:30 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 14A5 0
0 58ms
57ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssbuhjvWtnI50g3lTrg_d73CXONp-K2LOAAmW8P_2J1hJ4DYNqnCig6-_600VFKarGwOKI-x5WTOdTCBhJo86TiL5DPjiQWfH0A9r3C4j2TfyYZcOVhSuSrRiqC7JEI0qfpdiur3aQ51LNz9lip7Qas9kJI8P1cYpCLY0JlEP8tVyrw_A4zJOE1lUgSdXkpBVSIiMzG6f7vm1oPe7QTdiXsfth-yoMULjPSa0hyPzt_FnwtMLK9NXBBV38yt-QXCb0hiuRPvN71tdEKla_0UhwXAy5z5pT3VDH7KRDO7JKwm9om0sWtKXlYZ-yifAFK14gp9JR12gk1bOesV-Pv91AXEd0v3A&sai=AMfl-YS5yknOVdbSt432DuU20c7vLq91X1woRDBhwbu_7_2hIhGu4R5nnAbIKrxUBsdG0qqo3c9lB-iFeu6pGG1hqXTFdebtem2HuZq3e3Q1aXcm&sig=Cg0ArKJSzNL7BDeplgt6EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224021534/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 11 Aug 2022 07:00:30 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 14A5 26 KB
10 KB 68ms
28ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224021534/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
fastly-original-body-size: 8874
age: 32771
x-jsd-version: 1.13.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19137-FRA, cache-hhn4062-HHN
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=24EJ5qDIp2dZIhSdVW%2F4ety6iqXfyMSjkZkS8koC8kx%2F%2F808J16%2BknDjtrz6ENbdUwwauRgQMMl3%2FQT4I6h3xFVQguB7Ac%2Fd9IRy2wOzbyPyJwDm3LfWRxPO6euFm1hrE5kKD6QsiB5PxuTGfrU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 738f183bc94e9b83-FRA

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 14A5 140 KB
43 KB 87ms
45ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a2f253ec609c302adb1b3c7ae3e02520fe888f9b71507e7b9d32fc65d59db12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44011
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1659958456967243"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 07:00:30 GMT

GET
H3 200 container.html Show response
b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C6BC 6 KB
3 KB 65ms
27ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:30 GMT
expires: Fri, 11 Aug 2023 07:00:30 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 50A3 6 KB
3 KB 57ms
30ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:30 GMT
expires: Fri, 11 Aug 2023 07:00:30 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 32A1 6 KB
3 KB 52ms
28ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022080801.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:30 GMT
expires: Fri, 11 Aug 2023 07:00:30 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3B45 13 KB
5 KB 62ms
20ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 973
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 06:44:17 GMT
expires: Fri, 11 Aug 2023 06:44:17 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5734 783 B
1 KB 80ms
31ms Document
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

28acf5fa9719376c549fb17b5d83904edd9671d84b57011cedaa40d20e97872a

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WJobpi_bDzg6qhwDG4HC_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-WJobpi_bDzg6qhwDG4HC_A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:30 GMT
expires: Thu, 11 Aug 2022 07:00:30 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame DD95 13 KB
5 KB 68ms
20ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3198
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 06:07:12 GMT
etag: 12223946614886178233
expires: Fri, 12 Aug 2022 06:07:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 0F57 11 KB
5 KB 67ms
18ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05fdf9059f82368fa058a4fed88c9b56263934d770af68ea301f57f80be88ca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:30:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1807
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4665
x-xss-protection: 0
server: cafe
etag: 1690156577369591742
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 11 Aug 2022 07:30:23 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 0F57 85 KB
29 KB 99ms
26ms Script
application/x-javascript 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29216
Expires: Fri, 11 Aug 2023 07:00:30 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 0F57 0
817 B 67ms
19ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwheregoes.com%252Ftrace%252F20224021534%252F&e=wqT_3QKTBugTAwAAAwDWAAUBCI3S0pcGELiZs_CJx4ryfBgAKjYJW7BUF_Ayqz8RRIR_ETRmpD8ZAAAA4FG43j8hRA0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreM3ZBYABAYoBA1VTRJIBAQb0jwKYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQwMjE1MzQvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1DWWVSV1lPdHctb1plTGM2RlpnZFBFWE0wQWhkcVlkZkZKT1B2a2pmek9DR2VJUnkxaWlodnI4TWdNWWwzRGYwZkZCOXVZaXEyV1dGSHg5dXpIMVhxUHRsVFJGQSZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM4OTk5MzY0Mzc4MDUxMjY3NzY4Igg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMjE3LjExNC4yMTguMjSoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAEp6LLJYgFAZgFAKAFv_eehL7ztYwmwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwgAEAAYACAAMAA4vQZAAMgHzdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=296789b338a3da87bc858ed2f7003b6e608dd893

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e3c03133-1764-479f-9378-9da13917cbc2
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0F57 0
20 B 91ms
52ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-BItvHlNq7FM0Aa8yxXbVwVM_HNf-ffI0I1U7rPIkIRGcX1_HUHb28an1e6LSChPjcjB13RWGOdzIqKJnxdotmFQShyKw

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:30 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame C6BC 22 KB
7 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 18:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 563175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 04 Aug 2023 18:34:15 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame C6BC 8 KB
4 KB 61ms
20ms Script
application/javascript 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=199140746&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsuKb6ldZFIdCpoJH-Tg8FcfWFL3JvU6-FTCty_P3OQoyDDk3ZDwHgthbAMrQuI0vFyAATGgcbDE4Azb-myFOv2ZYqv4-uyYoKSW7aoZbj47Xv1vDWmspGb3I_qd6BGXLKgW4_c7kdO2QRxjGsi8kkH36JA19Vx_5eH89igWPn4El4UmeAZKKMMzc_jScXQHDbD_7C4rs7883UaWzj2umcGPz1xHciGBOspEw5QVv--aJNMyq761NpaqoZcAaHIA8L8t1itjkCQ7_Et46DqYA2ejiFKo_PKmlKeQZBLkf-Clq4IlC9MPtuGjV1iu_ex8lWCrStVh0-nRhG3f2us%2526sai%253DAMfl-YQ3-2ZyyZZi6S7THJ-uvjwF4VLu3mVarWY21-8-ZJ2nFW3ZMjnpFd_dY_8RVFFqPCrvEDpSub73W3cDnX6uRECP0k0Au846BVVyU2ue_cY_%2526sig%253DCg0ArKJSzCia4leoJeelEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

fe38c4b0c94a85ac5a26e753651e6712396d9dfdf9677a7b0ca09134c7084843

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 337c024d-4f0f-4382-8ea3-e8d7d2603076
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C6BC 140 KB
43 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a2f253ec609c302adb1b3c7ae3e02520fe888f9b71507e7b9d32fc65d59db12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44011
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1659958456967243"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 07:00:30 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 32A1 22 KB
7 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 18:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 563175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 04 Aug 2023 18:34:15 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 32A1 8 KB
4 KB 66ms
24ms Script
application/javascript 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=120x600&cb=836569151&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

ca6e1055db68ea2a1059ec98423908d234e0dbe159be3ac36788b291238f908a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 179fcfc8-7dd8-4cba-9d1c-e1d02e725788
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 32A1 140 KB
43 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a2f253ec609c302adb1b3c7ae3e02520fe888f9b71507e7b9d32fc65d59db12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44011
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1659958456967243"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 07:00:30 GMT

GET
DATA 200
OK truncated
/ Frame 14A5 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56704547ec475bd555ee50ed9b3d261fa68e93b165849da996a0ef9ff435511f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 50A3 22 KB
7 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 04 Aug 2022 18:34:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 563175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 04 Aug 2023 18:34:15 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 50A3 8 KB
4 KB 35ms
23ms Script
application/javascript 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1179012802&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsu3myDJJQWyVavVpKXCU2nf6JgPbv8qCLljZJ2aSiQPPtHEernCKxfWI1KflkB2CWQdDBDS9Yfq2kGhC4-jf4kGIrKueuD0sfGomXHIFXK0ca4OT6FZq7kWPFESXdQVCpNtwv_dePV7prql63DKvl_XYoQkqtQsD60SjeRr-fA5SScVz76E4WG5Dia3R256lqPGtjr0r7vI59JnJDyWrHDYOzojeRSKwQ_cS1vnBv39pg5m8bbLtmmmU_SWcyVlf2kmRgVu-lxgyFKgDVjyleSyaSisDjPJs5J3edomYCweReZsaJPgk5u72_BfdPtQkjxXm414m1PSJjdPfQn8WGDzfJDdDxxzsRJh%2526sai%253DAMfl-YTJZOKor4TNHGjjzq564-LcsaULT8u-1CZjCm-jM88lLBPDd9cBgclfRFIblYIu_TtanxcccJpayY7aTRaxibrHzr9YBOfOF0XO4bhv3TQ7%2526sig%253DCg0ArKJSzLWh7IC0bdXdEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

aa4f74bfadad99c8978c737e3475c51b10e3b5b3cf6e3a24f20415304218eefb

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 73f5067c-06f2-437b-989c-5eca87367d07
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 50A3 140 KB
43 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a2f253ec609c302adb1b3c7ae3e02520fe888f9b71507e7b9d32fc65d59db12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44011
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1659958456967243"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 07:00:30 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C6BC 0
0 59ms
59ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvkWOuml7nlIQ56faOsWrMe1soxJTK6oPwjeW5hs5UtOZnLcv54-wwapG3QfVt-pEAmqzJXzTTtLGKbqY0UCV55czIshSXtWCYwjPAJEFDIm9Mhl9xNNu9l2_GLq0fgxkppYyPSCDTKwVUpBVR05f188Dqtp9ZrbsfIm7ZHFJs0YcAX_szxDsrjGEV1fNzdojdl-sGYMdzr3ifaU2qae-LIT74j0N84rCWoMWO2rTJlp-Gov3-EUQBeMwsOoPOXYNaymJO7ozh2ZVmo0EconTiuvYXluA9fOi0HbKMUdHwJXZFFpZMMBvJgfq6mRmbCxUXH5wc3MnlndO6Gw84bw6k&sai=AMfl-YQ-FrS63Hu1-X-wBh2KlnjHEK8LNEOMQYDl-Q38tANycfJQU_FMYi0m4a1Sfm9k6i_e10nDcAV3jmwWApHzJa_IMhlhpTgJ-UoHU9NNRCiL&sig=Cg0ArKJSzIR6V4763rX9EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 32A1 0
0 60ms
59ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvMTu4eRDJSvsN137XcGVWAxWMd6aH0kt0ZtfiYfuyVOfW8mARul3rm9_IIjpulkBUrVkvLxv-pwPgqTlgLOPx5Dc6gywUNumtUJRrA9Yk6_Sk0_s1iIY_o1XIBwwIM8vKoB56DJSQ8xQ3ykqCSLkCmtgN2dUytcs6DX5f9GK9Zdyt-JrX5aeZ85ZbVgtlcHcdDFHsnNv7dHaJDUUzmZRkIE9qmcuQ8ph2lfgj0jpnuepvvTTdl-wesNBKJMnqztOWL8QdCYMTj-4P63NCus6gH0leqMdYj4K2AKrQn1rICE4YhhEQMRD-LpmaKFdRUf5nbWZaA35inFrfGxjg8E5iuJvugH9G_&sai=AMfl-YSrV1hxKvakQ_TxjTxXSOBptztFf6mnu05IjVC-5_4ufsqVkj0dLGNH5qJCZ9aohmJ3RWe021oJDx0wNz8ELl97i5h-kD11LVncVu0CgLh4&sig=Cg0ArKJSzDjO-HonUmdUEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sync Show response
gum.criteo.com/ Frame C6BC 51 B
377 B 115ms
39ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=199140746&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsuKb6ldZFIdCpoJH-Tg8FcfWFL3JvU6-FTCty_P3OQoyDDk3ZDwHgthbAMrQuI0vFyAATGgcbDE4Azb-myFOv2ZYqv4-uyYoKSW7aoZbj47Xv1vDWmspGb3I_qd6BGXLKgW4_c7kdO2QRxjGsi8kkH36JA19Vx_5eH89igWPn4El4UmeAZKKMMzc_jScXQHDbD_7C4rs7883UaWzj2umcGPz1xHciGBOspEw5QVv--aJNMyq761NpaqoZcAaHIA8L8t1itjkCQ7_Et46DqYA2ejiFKo_PKmlKeQZBLkf-Clq4IlC9MPtuGjV1iu_ex8lWCrStVh0-nRhG3f2us%2526sai%253DAMfl-YQ3-2ZyyZZi6S7THJ-uvjwF4VLu3mVarWY21-8-ZJ2nFW3ZMjnpFd_dY_8RVFFqPCrvEDpSub73W3cDnX6uRECP0k0Au846BVVyU2ue_cY_%2526sig%253DCg0ArKJSzCia4leoJeelEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1731
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame C6BC 3 KB
3 KB 99ms
85ms Script
application/javascript 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=199140746&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuKb6ldZFIdCpoJH-Tg8FcfWFL3JvU6-FTCty_P3OQoyDDk3ZDwHgthbAMrQuI0vFyAATGgcbDE4Azb-myFOv2ZYqv4-uyYoKSW7aoZbj47Xv1vDWmspGb3I_qd6BGXLKgW4_c7kdO2QRxjGsi8kkH36JA19Vx_5eH89igWPn4El4UmeAZKKMMzc_jScXQHDbD_7C4rs7883UaWzj2umcGPz1xHciGBOspEw5QVv--aJNMyq761NpaqoZcAaHIA8L8t1itjkCQ7_Et46DqYA2ejiFKo_PKmlKeQZBLkf-Clq4IlC9MPtuGjV1iu_ex8lWCrStVh0-nRhG3f2us%2526sai%253DAMfl-YQ3-2ZyyZZi6S7THJ-uvjwF4VLu3mVarWY21-8-ZJ2nFW3ZMjnpFd_dY_8RVFFqPCrvEDpSub73W3cDnX6uRECP0k0Au846BVVyU2ue_cY_%2526sig%253DCg0ArKJSzCia4leoJeelEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

96113029ee22c2b7ec776ca289a0e4a60ce27f506a4e0d3666de0e7add2b33cc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
X-Creative-ID: 41873055
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e25c42ed-a4cc-4e30-b403-952db87ed7f6
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5734 0
0 52ms
52ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022080801&jk=1102085089393110&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3 200 lIG_-rjQweUtsPTJkqViasoL1XPo6OtXzg5InKx-NMQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 3B45 36 KB
14 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lIG_-rjQweUtsPTJkqViasoL1XPo6OtXzg5InKx-NMQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9481bffab8d0c1e52db0f4c992a5626aca0bd573e8e8eb57ce0e489cac7e34c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 07:43:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170222
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14125
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 07:43:28 GMT

GET
H/1.1 200
OK rd_log Show response
fra1-ib.adnxs.com/ Frame 0F57 0
817 B 20ms
20ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&e=wqT_3QKKMugKGQAAAwDWAAUBCI3S0pcGELiZs_CJx4ryfBgAKjYJW7BUF_Ayqz8RRIR_ETRmpD8ZAAAA4FG43j8hRA0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreM3ZBYABAYoBA1VTRJIBAQb0jAOYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQwMjE1MzQv8gIMCgZIRUlHSFQSAjkw8gIMCgVXSURUSBIDNzI48gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIYCgpJRlJBTUVfS0VZEgoxODY3MzQ2ODU18gK_FQoLUFJFX1NDUklQVFMSrxU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBoPXRoaXN8fHNlbGY7LyoKCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aDtkKyspaWYoZCBpbiBhJiZhW2RdPT09YylyZXR1cm4gZDtyZXR1cm4tMX07ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW5jdGlvbiBwKGEsYyxkKXthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKTt2YXIgYj1uKGEuZG9jdW1lbnQpO2lmKGQpe3ZhciBlPWZ1bmN0aW9uKCl7aWYoZCl7dmFyIGY9YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMsZz1rKGYsYik7MDw9ZyYmQXJyYXldFxxzcGxpY2UuYyHpdGYsZywxKX1iLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGUsITEpO1IjAGI6ABBlcnJvcg07GH07Yi5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAXGIuc3JjPWM7YS5nb29nbGVfaW1hZ2Vfci0xLC5wdXNoKGIpfTtmdWnkqCBxKCl7dmFyIGE9ZG9jdW1lbnQuY3VycmVudFNjcmlwdDtyZXR1cm4oYT1dObBudWxsOmEpJiYiNzciPT09YS5nZXRBdHRyaWJ1dGUoImRhdGEtamMiKT9hOmQRVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEEF0nKX07AYfwSXI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1DeAAdBXgAGgFYQxjPVtdBQkEZD0Bxgg7ZG8F_xhiPWE7dHJ5BQwsZTtpZihlPSEhYiYmASRQIT1iLmxvY2F0aW9uLmhyZWYpYjp7AS2QbChiLmZvbyk7ZT0hMDticmVhayBifWNhdGNoKG0pe31lPSExfQHWCGY9ZRkXAGYBFgxpZihmKXkAZz5eABA7ZD1iLjGNIfQRDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_TH19d2hpbGUoYSYmYiE9YSk7Yj0whakQYT1jLmyFoXQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWghKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUoKWZvcihhPTE7YTwRikw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGgZqyHVZeUAZyUWJQIEZD0yBAEgMDw9ZDstLWQpIbpEPWNbZF0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGQV5gQmJgHMATsEOzBBZSVaCCYmZAVIARsIKTtjBa0UdihiLGcpbYsYIGMuZz9jLgX6DDpjLmkBQAB9ddAwdihhLGMpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCp0pAHd1SSB0KCksYz1hLmnpdkAoIj8iKTtzZXRUaW1lb3V0KBGMDTEEZD2VOhhkPy4wMTpkQTVEIShNYXRoLnJhbmRvbSgpPmQpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyjf8Qc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGU9KGUBsQwpJiZlWpkADTEwIil8fCJ1bmtub3duImHjXCtlKyImc2FtcGxlPSIrZDtiPXdpbmRvdwVYAGY5NBRmPyExOmYhMzRlPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGU9L0Nocm9tZS9JmyBlKSYmIS9FZGcZERw_ITA6ITE7ZWGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGQpOnAoYixkLDXSCZ4QKX19LDBVoFwwPD1jP2Euc3Vic3RyaW5nKDAsYyk6YX0J4BAucmZsPV0jGnoIaGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtQkl0dkhsTnE3Rk0wQWE4eXhYYlZ3Vk1fSE5mLWZmSTBJMVU3clBJa0lSR2NYMV9IVUhiMjhhbjFlNkxTQ2hQamNqQjEzUldHT2R6SXFLSm54ZG90bUZRU2h5S3ciIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRp8ZGlzcGxheTpub25lIj48L2Rpdj7yApoBCgxQT1NUX1MaEQwIiQE8KWo2CAEWWAhQYWRzLmcuZG91YmxlY2xpY2submV0MQY8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dJCgge3IzcHgoJzE4NhqdDBwnKTt9KSgpOz3rENMTChBIAZ40UE9SVF9QQVJBTVMSvhORJIqVAPB9YWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTIxNy4xMTQuMjE4LjI0Jm91dHB1dD1odG1sJnVudmlld2VkX3BvSYwgX3N0YXJ0PTEmoXcRvH4IDhAmc3ViXw2ZAGJBoPB9ci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1KWHRhZ0IxRjdRQS1WVTBBZnBZTkFHTllUUUJrbTAwQVJCMU5BR29kVFFCd0hVMEFXZDNOQUVOZURRQm0zZzBBV1Y2TkFIMGVqUUJuSHMwQWJ4N05BSEVlelFCem5zMEFlbDdOQUhzARBsSEh3MEFTMThOQUV1ZkRRQlJYdzBBVkY4TkFGYgEQBFhuARAAOQEQAGgBEABiARAEWHABEAA5ARAAZwEwGFlKOE5BR0YBEBhqM3cwQVo1ARAAdgEQAHQBYARiVgEQADMBEAB2ASD0lwJVdHpRUUZUYzBFQllCeGNBaHNlWEFKaUhsd0N6QjVjQXZtaVhRTFg5b2dDSjBLcUFpaENxZ0ljVWFvQ3ptR3FBbjFpcWdMd2Rxb0NxNUdxQWtXV3FnS0FtNm9DZ1p1cUFvS2JxZ0tpcUtvQ3VMMnFBaGpGcWdKcjBxb0NUTldxQXFiYXFnSlYzcW9Db09XcUFrVHFxZ0lIN0tvQ1ZleXFBb2ZzcWdJMjhhb0N3UEdxQXZieXFnTGI4Nm9DbF9TcUF2UDFxZ0pULUtvQ0p2dXFBa0w3cWdMSC02b0M5d1dyQW5RR3F3SldCNnNDMFFlckFoNEpxd0kxQ2FzQ2JnbXJBbE1NcXdMYkRhc0NJQkNyQWprUnF3TGFFYXNDVGhPckFtZ1Rxd0s0RTZzQ2hSZXJBbjBacXdKOUc2c0NoaHVyQW9BZXF3TG9IcXNDQWgtckFxTWZxd0tsSDZzQ3NoLXJBblVncXdMQ0lLc0NEeUdyQWpraHF3SkNJYXNDUlNHckFuWWhxd0lLSXFzQ0ZDS3JBam9pcXdKdklxc0NjeUtyQW9RaXF3SWhJNnNDUWlPckF1NGpxd0xXSktzQ0RpYXJBa0ltcXdKWkpxc0NuQ2FyQXAwbXF3THlKcXNDLWlhckFpZ25xd0pNSjZzQ0llMEZBX1YwSkFRRDU1OExab3FORUlpMC14SXo0dnNTQ2VqN0VuenMteEtwN19zU0dmTDdFb0gxLXhLWDlmc1N5Zmo3RXN2NC14SVYtX3NTeV96N0VsZi0teEo1X3ZzU1dRSDhFbndCX0JLZzdJOFQ4bHZRRThUMUF4VVpaWEVXRFZ3M0Y1ckxIQmo0Vm1zYTdWekxKZyZleGs9MTg2NzM0Njg1NSZhd2JpZF9jrdz0ggZDSDVhOXdmTEk1R0hJZmF0dUxVNkxFMTZtUkRSTklGT3IzRHBYQVZ3MnJkMnpIOHlVTU9QWl96c0FCOFBnVHdZTFZYa0d2VFM3NTczOWNRdTJCd1RwcEdzV0JYRk81N0N5ZGR1Wjl2ZFo1N2tDSDJCd0xySGJ2eElveVBoeWN1UnUzenpzMG5BczFzOEpzTVMxOHNWLVNMcnpFVGVSWWFUdFU0RTZ5cWpTcTR6ZzBFbHMmYXdiaWRfZD1BS0FtZi1EY3FhRzV0UjE3YjBEQVpjanpIN1VNdkpOQzlSS0RsaUVweWNtQnlWMW96MUtFckV0MjRTZ1hLczZRSDFwSkREUFNDSHBOcjljMzlTclN1WERLOEFLdmptOXR1VVNnNm9DS3pYZUZjeVViREp2dWhfMjUxTnBvVTQ4Q3ltTFBDQ0J3VE5lQzhKM25scUdINDFxQ3hQQURwSXdZSkFRTGVLSU5LRW1VU2MtVy1qbnpzNHlacUxXajRiTE83R1JqYUZkV2RSeUc4djN4YnZ4N2pNWEd3YVFQVmhGbkVHcTgxbjN4cEVnR0NkYTZuSUs4V2ROa3hFWTNES1BwdkVWU0ZSRlk5WDJ3TEFma3ZqY1JWMk43ZHhxcHZCUHR4MU1WeERma3hULWZKRWpOZTJRdGNRb01sVXpxTjdQc3Z0bFNjM3lTSDRvYVoweVFjY0dPczU3aU9Jd1RqOXBoT1dXSWljMTh5UnIyUkh1QWRTbDlpMEttM0VUeHdKYU4tNDc1WHVNUUxKU1VEZGtHV1lSVmF3dk1QRVNBdmV4VVpaRWVnTmRfaDEzaDd5YlpzSFB2QW9vY1lDU3lnNUdaNURsbWVkcXRtNllUel82UWxiYUhQZ2tTUGFUZUdkSl9UNk0teEw3eVIzbUVNTElNY3JTTWpNTkJPWERhbzdLRkEwQm1PWlhGN0FMdXE3amtSNDFzeUJwMjE2eUE5TXBPNTRjSmxWMFBEcEJvOFR6Q3J2eWhGT3YtSGZydnhCSEZVVnhWUnRSWkEwdWZDSmJYeERDNHlTVzdCZjA0OVVmOERlNTdNdy13SXppTUhaRE80eV9acmtYV0ZhTGVBaFI5eXZuX3ZzVGNrS0tXMVE4UzVsOHpVVHU5bFJveUcxWS1tUFZPUjhHazhxdDNrWWRMOWVCTS1VbVQyU3NJZ2JhNkJ0aF9adFpVYWlWb1pmUDR1a1V6VC1NcWpFa1o1VTM2SDV6RWFvbmk4a2kzVkcySWhXZDBQYjhLTmFwbXg0Q3NBbW9VYmpfLThIZEYwTTBKcmZDRTAzclc3a3R4cmlsNjRpS2ZNNGRfY0lhZXZzLVg0cDVVaUJDTjdJcklSWjNsUTRFMlJoNzZpWWdTZzlQeUd0TnA4bTZDZ0o1UmswNHV5X2s1YzR4Z1dqMFhDNlNIY2NKSW1BSjlLYl9Tb3V0bGJWVjRXWGMtSllBRVNfVHREQ2txaFBPR09GTTNBM1k0ZDRfWWpSU3BpeTBvSUF0VEcwTHNnTzV0clZONFpENHZsdVI1TEtxR2xiakI3OVpHVTNKY1VscU1RY0YwWEZlNWZuY2hkZEI3ODBjcWN6Zk1jMFlmeklWcGxZR0FXNi1EUUl4aUFfSlg0dGNINlpoN3hVbG9qNGxrQTU3OUJfbWdmMWNpNEJfVmM5aWxoaFVkUm56Nnc3QzJwa2NyTC1TY2d6VmF3TWJOWWlGenpKTmt1OGdtZXdaYjNGLWxHelVoRkEmY2lkPUNBQVNCT1JvbzRrJmFfY2lkPYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMjE3LjExNC4yMTguMjSoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAEp6LLJYgFAZgFAKAFv_eehL7ztYwmwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwgAEAAYACAAMAA4vQZAAMgHzdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=4415dca8cb4fe76238935e5ee6dbf66415b14c79&bdref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224021534/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ddb2f3b3-883b-4054-986d-ff646b9bab76
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 50A3 0
0 58ms
58ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuKtPSkNJFX5sv6O2w-bULS67lUfjjy320WcCm4v_NIxgVwXFtxdfllFdyGcnxYX7Ul14D7_cHN6-qhrfZbCuu41ZhZIEsHNvynSfUx69pOvQcmRQTqVCApIvOQ1hYpGJ22ytQTUmYip0K6QPA8LDWiodUiqBWDw6xF_i5CvRQ8Iz0bQ0MKnUeM7x2CEsDYs9dWP5cTGdXf1UccgR13-JI4pR2MO_VmgxBwNgct66FWS7gjWKpGNbPQajaEdH9hgh4F22JfbDSWYxUyXjUthCgLCT5X7HQOQ5Qx9E1sJojGiZT2WleqNr2jjZirfO1IYSzuB2VEH579EUq_H5TeSiah6ZKKqW4oV8cmD5pk&sai=AMfl-YRWssn9J_RqcrClsh3e4_s8ba3u28LdZDuYr_p6_tnpRKs2ubiZ5e61N7Ze2lZ3eb-T0j8M9Lo7K4oyAgWSYLJq9JYJHhFXWB3Dfdwu3Pf_&sig=Cg0ArKJSzFzhSBBRKEO8EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sync Show response
gum.criteo.com/ Frame 50A3 51 B
376 B 90ms
40ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=1179012802&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsu3myDJJQWyVavVpKXCU2nf6JgPbv8qCLljZJ2aSiQPPtHEernCKxfWI1KflkB2CWQdDBDS9Yfq2kGhC4-jf4kGIrKueuD0sfGomXHIFXK0ca4OT6FZq7kWPFESXdQVCpNtwv_dePV7prql63DKvl_XYoQkqtQsD60SjeRr-fA5SScVz76E4WG5Dia3R256lqPGtjr0r7vI59JnJDyWrHDYOzojeRSKwQ_cS1vnBv39pg5m8bbLtmmmU_SWcyVlf2kmRgVu-lxgyFKgDVjyleSyaSisDjPJs5J3edomYCweReZsaJPgk5u72_BfdPtQkjxXm414m1PSJjdPfQn8WGDzfJDdDxxzsRJh%2526sai%253DAMfl-YTJZOKor4TNHGjjzq564-LcsaULT8u-1CZjCm-jM88lLBPDd9cBgclfRFIblYIu_TtanxcccJpayY7aTRaxibrHzr9YBOfOF0XO4bhv3TQ7%2526sig%253DCg0ArKJSzLWh7IC0bdXdEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 2082
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 50A3 9 KB
7 KB 178ms
178ms Script
application/javascript 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1179012802&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsu3myDJJQWyVavVpKXCU2nf6JgPbv8qCLljZJ2aSiQPPtHEernCKxfWI1KflkB2CWQdDBDS9Yfq2kGhC4-jf4kGIrKueuD0sfGomXHIFXK0ca4OT6FZq7kWPFESXdQVCpNtwv_dePV7prql63DKvl_XYoQkqtQsD60SjeRr-fA5SScVz76E4WG5Dia3R256lqPGtjr0r7vI59JnJDyWrHDYOzojeRSKwQ_cS1vnBv39pg5m8bbLtmmmU_SWcyVlf2kmRgVu-lxgyFKgDVjyleSyaSisDjPJs5J3edomYCweReZsaJPgk5u72_BfdPtQkjxXm414m1PSJjdPfQn8WGDzfJDdDxxzsRJh%2526sai%253DAMfl-YTJZOKor4TNHGjjzq564-LcsaULT8u-1CZjCm-jM88lLBPDd9cBgclfRFIblYIu_TtanxcccJpayY7aTRaxibrHzr9YBOfOF0XO4bhv3TQ7%2526sig%253DCg0ArKJSzLWh7IC0bdXdEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

294d692cf52e8cac8e5c228abc9a536ef12eb3d637adb2745bf0b59b03993a8a

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:31 GMT
Content-Encoding: gzip
X-Creative-ID: 78827815
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 702d5ab4-90a6-4fc0-9c34-2558d84dbd53
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 32A1 51 B
376 B 89ms
39ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=120x600&cb=836569151&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1744
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 32A1 3 KB
3 KB 266ms
266ms Script
application/javascript 37.252.173.22
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=120x600&cb=836569151&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.22 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

0dc21d5ec7ece9aa82626c6d0f2287ed393e17c362f175220fa011dd797d9b87

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:31 GMT
Content-Encoding: gzip
X-Creative-ID: 56842500
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 77ca760d-dadd-4793-949a-ba555ab26b55
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame DD95 99 KB
34 KB 136ms
97ms XHR
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f75a555dbb16b9f37f303815273c148d83ead9f42fb0a9eae99547ebec673459

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34556
x-xss-protection: 0

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 0F57 0
837 B 20ms
20ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&e=wqT_3QKTBugTAwAAAwDWAAUBCI3S0pcGELiZs_CJx4ryfBgAKjYJW7BUF_Ayqz8RRIR_ETRmpD8ZAAAA4FG43j8hRA0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreM3ZBYABAYoBA1VTRJIBAQb0jwKYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQwMjE1MzQvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1DWWVSV1lPdHctb1plTGM2RlpnZFBFWE0wQWhkcVlkZkZKT1B2a2pmek9DR2VJUnkxaWlodnI4TWdNWWwzRGYwZkZCOXVZaXEyV1dGSHg5dXpIMVhxUHRsVFJGQSZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM4OTk5MzY0Mzc4MDUxMjY3NzY4Igg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMjE3LjExNC4yMTguMjSoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAEp6LLJYgFAZgFAKAFv_eehL7ztYwmwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwgAEAAYACAAMAA4vQZAAMgHzdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=296789b338a3da87bc858ed2f7003b6e608dd893&type=nv&nvt=5&jm=1003&px=436&py=474&bw=728&bh=90&sid=3918087281505633285&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&sw=1600&sh=1200&pw=1600&ph=2226&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9495634a-1b8d-4754-8b17-10fda3bd2574
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 14A5 0
0 103ms
59ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstQ4Pn0BeMX20Kjnh08olUBVj1q5pI6rfwz8dmUFMKaIqbUZALXsro_41YyjSX7Ac3OKgNjQRLtOq5AN9ik-R0zQD-bRviFrpVbWExL_iy6BVl6XJdaRnyGCGuCnQvaZAws2vpVXQkAjLwmnQi8DxlI8UHwGkNwgsr7fTQzpfHXXuRvZLQYvitu-VCPM0TyiupwyreM_xtpYcQKHLCFYhqSjUsxG9ayJj3aYyU33bp47p_NdqheIG07ExeGzlixGS1DBjbw0nyjh91p9UIgvUBR6nohhSuLpRvlhgVNlz4hI5_iw6AKLtQzy8G6xPCKt3luQJbFlx_HEf5OTSa5dlt9Gh1Ppw3O&sai=AMfl-YTZox8f4e83r7zAyDQbHGlejM3T_A5W6VHM9xWvp9uCort86EMzG2jhuz1tIElkKADCIjSjfrVU9HbE4AVAuDMWhjao29PTFJS0pfa8HVMg&sig=Cg0ArKJSzLyAyGnugIL4EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:30 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 11 Aug 2022 07:00:30 GMT

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame C6BC 4 KB
3 KB 21ms
20ms Script
application/javascript 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?id=6589253&psa=0&cb=1833065698&gdpr=0&gdpr_consent=&loc=,&pubclick=https://fra1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAADXo8A_AAAAAAAAAAAAAAAAAAAAAHvSVWiPoswN8tkmU_jfwH0OqfRiAAAAAGMBHQHKIAAA5QAAAAIAAACf7n4CmKoUAAAAAAAAAAAAVVNEACwB-gBrrgAAAAABAgEAAAAAAMwApRegDAAAAAA./bcr=AAAAAAAAAAA=/bn=0/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuKb6ldZFIdCpoJH-Tg8FcfWFL3JvU6-FTCty_P3OQoyDDk3ZDwHgthbAMrQuI0vFyAATGgcbDE4Azb-myFOv2ZYqv4-uyYoKSW7aoZbj47Xv1vDWmspGb3I_qd6BGXLKgW4_c7kdO2QRxjGsi8kkH36JA19Vx_5eH89igWPn4El4UmeAZKKMMzc_jScXQHDbD_7C4rs7883UaWzj2umcGPz1xHciGBOspEw5QVv--aJNMyq761NpaqoZcAaHIA8L8t1itjkCQ7_Et46DqYA2ejiFKo_PKmlKeQZBLkf-Clq4IlC9MPtuGjV1iu_ex8lWCrStVh0-nRhG3f2us%2526sai%253DAMfl-YQ3-2ZyyZZi6S7THJ-uvjwF4VLu3mVarWY21-8-ZJ2nFW3ZMjnpFd_dY_8RVFFqPCrvEDpSub73W3cDnX6uRECP0k0Au846BVVyU2ue_cY_%2526sig%253DCg0ArKJSzCia4leoJeelEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=199140746&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuKb6ldZFIdCpoJH-Tg8FcfWFL3JvU6-FTCty_P3OQoyDDk3ZDwHgthbAMrQuI0vFyAATGgcbDE4Azb-myFOv2ZYqv4-uyYoKSW7aoZbj47Xv1vDWmspGb3I_qd6BGXLKgW4_c7kdO2QRxjGsi8kkH36JA19Vx_5eH89igWPn4El4UmeAZKKMMzc_jScXQHDbD_7C4rs7883UaWzj2umcGPz1xHciGBOspEw5QVv--aJNMyq761NpaqoZcAaHIA8L8t1itjkCQ7_Et46DqYA2ejiFKo_PKmlKeQZBLkf-Clq4IlC9MPtuGjV1iu_ex8lWCrStVh0-nRhG3f2us%2526sai%253DAMfl-YQ3-2ZyyZZi6S7THJ-uvjwF4VLu3mVarWY21-8-ZJ2nFW3ZMjnpFd_dY_8RVFFqPCrvEDpSub73W3cDnX6uRECP0k0Au846BVVyU2ue_cY_%2526sig%253DCg0ArKJSzCia4leoJeelEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

159f7d0defc72b578decca4cfa493e2d2a38eb602ae31f36664c8cfd73ac7b39

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: ec346f12-5c77-440a-9b20-e1bc5b945eaf
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame C6BC 0
817 B 21ms
21ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLzCKBzBAAAAwDWAAUBCI7S0pcGEPuk18L20ajmDRjys5uZhf-34H0qNgkAAAkCABEJBwgAABkBCRDXo8A_IQEJAQEAKQEFAQH0HwQxAAAA4FG4nj8w44L0CDjKQUDlAUgCUJ_d-xNYmNVSYABo69yaAXgAgAEBigEAkgEDVVNEmAGsAqAB-gGoAQGwAQC4AQLAAQHIAQDQAQDYAQDgAQDqAYAFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlY2xpY2submV0JTJGcGNzJTJGY2xpY2slMjUzRnhhaSUyNTNEQUtBT2pzdUtiNmxkWkZJZENwb0pILVRnOEZjZldGTDNKdlU2LUZUQ3R5X1AzT1FveUREazNaRHdIZ3RoYkFNclF1STB2RnlBQVRHZ2NiREU0QXpiLW15Rk92MlpZcXY0LXV5WW9LU1c3YW9aYmo0N1h2MXZEV21zcEdiM0lfcWQ2QkdYTEtnVzRfYzdrZE8yUVJ4akdzaThra0gzNkpBMTlWeF81ZUg4OWlnV1BuNEVsNFVtZUFaS0tNTXpjX2pTY1hRSERiRF83QzRyczc4ODNVYVd6ajJ1bWNHUHoxeEhjaUdCT3NwRXc1UVZ2LS1hSk5NeXE3NjFOcGFxb1pjQWFISUE4TDh0MWl0amtDUTdfRXQ0NkRxWUEyZWppRktvX1BLbWxLZVFaQkxrZi1DbHE0SWxDOU1QdHVHalYxaXVfZXg4bFdDclN0VmgwLW5SaEczZjJ1cyUyNTI2c2FpJTI1M0RBTWZsLVlRMy0yWnl5WlppNlM3VEhKLXV2andGNFZMdTNtVmFyV1kyMS04LVpKMm5GVzNaTWpucEZkX2RZXzhSVkZGcVBDcnZFRHBTdWI3M1czY0RuWDZ1UkVDUDBrMEF1ODQ2QlZWeVUydWVfY1lfJTI1MjZzaWclMjUzRENnMEFyS0pTekNpYTRsZW9KZWVsRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABANgCAOACn_A_6gIWaHR0cHM6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoDAMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQOMjE3LjExNC4yMTguMjSoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAOAEAPAEn937E4gFAZgFAKAFAMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQDwBQD6BQQIABAAkAYAmAYAuAYAwQYAAAAAAAAAANoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgDyBgIIAIAHAYgHAKAHALoHDwgAEAAYACAAMAA4vQZAAMgHANIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAH0tEBiggCEACVCAAAgD-YCAE.&s=9a1b0751d65f967c6e3122fc992912ab6dfaaf59

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:30 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e948d3bb-6bb8-4bbe-8394-479111f996e3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 3B45 0
9 B 20ms
19ms Image
text/plain 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?MbEJQg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame C6BC 4 KB
4 KB 51ms
51ms Script
application/javascript 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=6589253&psa=0&cb=1833065698&gdpr=0&gdpr_consent=&loc=%2C&pubclick=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick%3FAAAAAAAAAAAAAAAAAAAAAAAAAADXo8A_AAAAAAAAAAAAAAAAAAAAAHvSVWiPoswN8tkmU_jfwH0OqfRiAAAAAGMBHQHKIAAA5QAAAAIAAACf7n4CmKoUAAAAAAAAAAAAVVNEACwB-gBrrgAAAAABAgEAAAAAAMwApRegDAAAAAA.%2Fbcr%3DAAAAAAAAAAA%3D%2Fbn%3D0%2Fclickenc%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuKb6ldZFIdCpoJH-Tg8FcfWFL3JvU6-FTCty_P3OQoyDDk3ZDwHgthbAMrQuI0vFyAATGgcbDE4Azb-myFOv2ZYqv4-uyYoKSW7aoZbj47Xv1vDWmspGb3I_qd6BGXLKgW4_c7kdO2QRxjGsi8kkH36JA19Vx_5eH89igWPn4El4UmeAZKKMMzc_jScXQHDbD_7C4rs7883UaWzj2umcGPz1xHciGBOspEw5QVv--aJNMyq761NpaqoZcAaHIA8L8t1itjkCQ7_Et46DqYA2ejiFKo_PKmlKeQZBLkf-Clq4IlC9MPtuGjV1iu_ex8lWCrStVh0-nRhG3f2us%2526sai%253DAMfl-YQ3-2ZyyZZi6S7THJ-uvjwF4VLu3mVarWY21-8-ZJ2nFW3ZMjnpFd_dY_8RVFFqPCrvEDpSub73W3cDnX6uRECP0k0Au846BVVyU2ue_cY_%2526sig%253DCg0ArKJSzCia4leoJeelEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: ib.adnxs.com
URL: https://ib.adnxs.com/ttj?id=6589253&psa=0&cb=1833065698&gdpr=0&gdpr_consent=&loc=,&pubclick=https://fra1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAADXo8A_AAAAAAAAAAAAAAAAAAAAAHvSVWiPoswN8tkmU_jfwH0OqfRiAAAAAGMBHQHKIAAA5QAAAAIAAACf7n4CmKoUAAAAAAAAAAAAVVNEACwB-gBrrgAAAAABAgEAAAAAAMwApRegDAAAAAA./bcr=AAAAAAAAAAA=/bn=0/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsuKb6ldZFIdCpoJH-Tg8FcfWFL3JvU6-FTCty_P3OQoyDDk3ZDwHgthbAMrQuI0vFyAATGgcbDE4Azb-myFOv2ZYqv4-uyYoKSW7aoZbj47Xv1vDWmspGb3I_qd6BGXLKgW4_c7kdO2QRxjGsi8kkH36JA19Vx_5eH89igWPn4El4UmeAZKKMMzc_jScXQHDbD_7C4rs7883UaWzj2umcGPz1xHciGBOspEw5QVv--aJNMyq761NpaqoZcAaHIA8L8t1itjkCQ7_Et46DqYA2ejiFKo_PKmlKeQZBLkf-Clq4IlC9MPtuGjV1iu_ex8lWCrStVh0-nRhG3f2us%2526sai%253DAMfl-YQ3-2ZyyZZi6S7THJ-uvjwF4VLu3mVarWY21-8-ZJ2nFW3ZMjnpFd_dY_8RVFFqPCrvEDpSub73W3cDnX6uRECP0k0Au846BVVyU2ue_cY_%2526sig%253DCg0ArKJSzCia4leoJeelEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

1699876a2eebd938e7558f46284eb0f4804f80e07e1a7561b504cb098cd4eeb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:30 GMT
Content-Encoding: gzip
X-Creative-ID: 321852762
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8895df65-4bbc-427b-8dec-7ce913e2f4c0
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK a581941b-06fe-49c4-a861-b12a55f2af51.jpg
crcdn01.adnxs-simple.com/creative/p/3854/2021/11/5/29608705/ Frame C6BC 24 KB
25 KB 110ms
22ms Image
image/jpeg 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crcdn01.adnxs-simple.com/creative/p/3854/2021/11/5/29608705/a581941b-06fe-49c4-a861-b12a55f2af51.jpg
Requested by: Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: nginx/1.19.0 /
Resource Hash: c3745e24e22af4e75bdd5537552c3de4b309b9864d2098bf376b000527587b81

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:31 GMT
Last-Modified: Fri, 05 Nov 2021 17:27:15 GMT
Server: nginx/1.19.0
x-amz-request-id: 591598c5-33d7-47bd-b289-9754ca5a8edf
X-Clv-Request-Id: 591598c5-33d7-47bd-b289-9754ca5a8edf
ETag: "ad51244c260fe742b86a01f9ce8f1ab1"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=3888000
X-Clv-S3-Version: 2.5
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 24698
Expires: Sun, 25 Sep 2022 07:00:31 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame C6BC 0
817 B 24ms
22ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKdEaCdCAAAAwDWAAUBCI7S0pcGEPrf_OuDyoPJExjys5uZhf-34H0qNgkAAAECCPA_EQEHEAAA8D8ZEQkAIREJACkRCQAxEQmoMMWWkgM4jh5Ajh5IAlDaqryZAVio-zlgAGj2r1V40dgFgAEBigEDVVNEkgUG8FKYAawCoAH6AagBAbABALgBAsABA8gBAtABANgBAOABAOoBhAdodHRwcyUzQSUyRiUyRmZyYTEtaWIuYWRueHMuY29tJTJGY2xpY2slM0ZBQUFBQVIDABREWG84QV9SGwBoSHZTVldpUG9zd044dGttVV9qZndIME9xZlJpBTAwR01CSFFIS0lBQUE1UQESAQokQ2Y3bjRDbUtvVQESEQE0VlZORUFDd0ItZ0JycmcFFgxCQWdFBQkgQU13QXBSZWdECQ4gLiUyRmJjciUzDRAFAQglM0QBFxRuJTNEMCUN1xhlbmMlM0RoMgQBCGFkYwHyIC5nLmRvdWJsZQkOIG5ldCUyRnBjcxE7HCUyNTNGeGFpAQj0XgFEQUtBT2pzdUtiNmxkWkZJZENwb0pILVRnOEZjZldGTDNKdlU2LUZUQ3R5X1AzT1FveUREazNaRHdIZ3RoYkFNclF1STB2RnlBQVRHZ2NiREU0QXpiLW15Rk92MlpZcXY0LXV5WW9LU1c3YW9aYmo0N1h2MXZEV21zcEdiM0lfcWQ2QkdYTEtnVzRfYzdrZE8yUVJ4akdzaThra0gzNkpBMTlWeF81ZUg4OWlnV1BuNEVsNFVtZUFaS0tNTXpjX2pTY1hRSERiRF83QzRyczc4ODNVYVd6ajJ1bWNHUHoxeEhjaUdCT3NwRXc1UVZ2LS1hSk5NeXE3NjFOcGFxb1pjQWFISUE4TDh0MWl0amtDUTdfRXQ0NkRxWUEyZWppRktvX1BLbWxLZVFaQkxrZi1DbHE0SWxDOU1QdHVHalYxaXVfZXg4bFdDclN0VmgwLW5SaEczZjJ1cyUyNTI2c2EtZPCfTWZsLVlRMy0yWnl5WlppNlM3VEhKLXV2andGNFZMdTNtVmFyV1kyMS04LVpKMm5GVzNaTWpucEZkX2RZXzhSVkZGcVBDcnZFRHBTdWI3M1czY0RuWDZ1UkVDUDBrMEF1ODQ2QlZWeVUydWVfY1lfJTI1MjZzaWclMjUzRENnMEFyS0pTekNpYTRsZW9KZWVsRUFFJTI1MjZmYnNfYWVpZEUKOCUyNTVCZ3dfZmJzYWVpZAEPARQcMjZ1cmxmaXgFJCgxJTI1MjZhZHVybAUQiPABAIoCWXVmKCdhJywgMjkxMzk5NCwgMTY2MDIwMTIzMCk7AR0oaScsIDY0MjU5MzhGHQAwcicsIDMyMTg1Mjc2MjYfAPCLkgKBBCFFMVRSLWdpU3RiQVlFTnFxdkprQkdBQWdxUHM1TUFBNEFFQUVTSTRlVU1XV2tnTllBR0R5QTJnQWNBQjRBSUFCQUlnQkFKQUJBWmdCQWFBQkFhZ0JBYkFCQUxrQktZdUlnd0FBQUVEQkFTbUxpSU1BQVBBX3lRRUFBQUFBQUFEd1A5a0JBQUEFDnA4RF9nQWRLYWlBUDFBUUFBZ0QtWUFnQ2dBZ0cxQWXaBEM5CQgARAEd8E9JQWdEUUFnRFlBZ0RnQWdEb0FnRDRBZ0NBQXdHWUF3RzZBd2xHVWtFeE9qVTJOempnQTRFdmdBU0YzSjRIaUFTNjVKNEhrQVFBbUFRQndRUQWEBQEETWuNPwEBGERZQkFEeEIBCw0BGGlBV3VMS2uV-hA4RC14QoWmCQEEd1GRoQxEd1A4GSgMQUVEUi4oAAAyLigAaC1BRm9JMEc4QVgzME9VSC1BWEs3YkVCZ2dZRIHiOGlBWUFrQVlCbUFZQW9RWQlpAWAkNmdHQkxJR0pBaw0UDEFBQUIdvwRCawESCQEAQx0YRExnR0NnLi6aApkBIWdSRXk2UToFAihLajdPU0FFS0FBeAk-XEFBOEQ4NkNVWlNRVEU2TlRZM09FQ0JMMBFhDER3UDEdYQBGERgMQUFBRx0YAEcdGABIHRgMSGdBaS4ZAjR3Li7YAgDgArnQMOoCFqWMLDovL3doZXJlZ29lc8GG8HkvgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4yMTcuMTE0LjIxOC4yNKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjM4NTQjRlJBMTo1Njc42gQCCADgBADwBOVlIIgFAZgFAKAF_xEBGAHABQDJBQAFARTwP9IFCQkFC0AAAADYBQHgBQHwBYOVJ_oFBAFuKJAGAJgGALgGAMEGASHh7CDQBqEP2gYWChAJERkBXBAAGADgBgHyBgIIAIAHAYgHAKAHAboHDwFIBBgABbYsvQZAAMgH0dgF0gcNFXYBOAjaBwYJJ2jgBwDqBwIIAPAH0tEBiggCEACVCAAAgD-YCAE.&s=194723e7687e8b9d83dc6a49b06a589dd39d1b00

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e9db2e61-7694-4756-9159-755539577324
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 4E31 52 KB
17 KB 97ms
20ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 8345
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 11 Aug 2022 07:00:31 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 03 Aug 2022 04:41:10 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 218105, 133621
X-Served-By: cache-lga21969-LGA, cache-hhn4050-HHN
X-Timer: S1660201231.106503,VS0,VE0

GET
H2 200 css
fonts.googleapis.com/ Frame DD95 8 KB
1 KB 74ms
27ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 11 Aug 2022 06:39:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 11 Aug 2022 07:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 11 Aug 2022 07:00:31 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame DD95 2 KB
1 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623cd019389b2c8dcd7a61982ff834b85f6082663474f08b784e07f0c3fb954d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:59:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1202
x-xss-protection: 0
server: cafe
etag: 10137335727447750368
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:59:02 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/ Frame DD95 31 KB
12 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73a8c4643090bc508a479abca9b19393744e21ab711641ee147c2495dfd3d8b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:55:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11917
x-xss-protection: 0
server: cafe
etag: 3600686600815956419
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:55:08 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame DD95 3 KB
1 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabeba94738a961f0e3ee62c071f3d3759cb1bc06fad8a9f487bd28586203ba0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:59:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1431
x-xss-protection: 0
server: cafe
etag: 17826921741551292351
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:59:39 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DD95 140 KB
43 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a2f253ec609c302adb1b3c7ae3e02520fe888f9b71507e7b9d32fc65d59db12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44011
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1659958456967243"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 07:00:31 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame DD95 26 KB
10 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7872900e6e1637d3307f8d3d640907ee51aab404f0a2685a4c54254caac025d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:53:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 396
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10372
x-xss-protection: 0
server: cafe
etag: 3359820733324659293
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:53:55 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DD95 0
0 74ms
27ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQjzYx8yIHf6V9ZnkABAUzSiokPhlMfvBdf527eqCPAMz983CxE2nUQ2hMQ-J7xm5-8nF0tiAQdELpXRUjL2IsRhNNlzw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H2 200 8ab3c530fd8e92b79021f3068786d509.js Show response
www.gstatic.com/mysidia/ Frame DD95 42 KB
17 KB 75ms
21ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8ab3c530fd8e92b79021f3068786d509.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

125e014d00c3569891c3689625973016278837e431c2f029728552316e38d4d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 22:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30554
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16306
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 21:59:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 08 Nov 2022 22:31:17 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DD95 0
17 B 63ms
63ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CyONJDqn0YswoxYfZ9w_WjpCoC77m2ZFo78SHi-8OnbL0j4cdEAEg5pfWJWCVgoCAmAegAfD27pEDyAEBqQJzvfUwJUOxPqgDAcgDywSqBMcBT9B1GyHUsRVH-fnL-S4nGy8DZcrfmAKRbfK2I7hLNQRzVVY55V5gZmKHJACGHu0NBw6_8WS76lCChCsHmn4jxsWr_iSnP2VvR8GGQzqfLRH0yOyFO_P2ZRrs3NB-WUQSYkMRzcLXBhWnl_Tc-YYXqQUthF7LRxH1jLVdBCUncT1gmlDXqnRysV8rFOF6rWJjsNq6ATqlw3HK3Rhgeu0MMAX5HXQ_31tfmUBWZ47r-Z-0KIKHFUD8KZ1_fVXvzxXA-gvyRXYxwMAE3OzYu4sDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGAB_iIkW6oB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAdIIEQiA4YAQEAEYADICqgI6AoBA8ggOYmlkZGVyLTMwNTY0NDeACgTICwHYEwyIFBHQFQGAFwGyFwgKBggAEgAYAA&sigh=noM2wlJbuIg&uach_m=[UACH]&pr=10:0.053123&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 11 Aug 2022 07:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame C6BC 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 221f5f41269586850e7190b40af8081014ff7296a214fa93647072f2557ae9d4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK if Show response
fra1-ib.adnxs.com/ Frame E090 10 KB
6 KB 22ms
22ms Document
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLAN_BMwBsAAAMA1gAFAQiO0tKXBhCmyJyJ79Sk5VwY8rObmYX_t-B9KjYJjSYXY2Adpz8R6lxRSghWoT8ZAAAAgOtR2D8h6lxRSghWoT8pjSYJJMgxAAAA4FG4nj8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvBAmAHYBaABWqgBAbABALgBAsABBcgBAtABANgBAOABAOoBkQVodHRwcyUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGUJDixuZXQlMkZwY3MlMkYFEhwlMjUzRnhhaQEI9AIFREFLQU9qc3UzbXlESkpRV3lWYXZWcEtYQ1UybmY2SmdQYnY4cUNMbGpaSjJhU2lRUFB0SEVlcm5DS3hmV0kxS2Zsa0IyQ1dRZERCRFM5WWZxMmtHaEM0LWpmNGtHSXJLdWV1RDBzZkdvbVhISUZYSzBjYTRPVDZGWnE3a1dQRkVTWGRRVkNwTnR3dl9kZVBWN3BycWw2M0RLdmxfWFlvUWtxdFFzRDYwU2plUnItZkE1U1NjVno3NkU0V0c1RGlhM1IyNTZscVBHdGpyMHI3dkk1OUpuSkR5V3JIRFlPem9qZVJTS3dRX2NTMXZuQnYzOXBnNW04YmJMdG1tbVVfU1djeVZsZjJrbVJnVnUtbHhneUZLZ0RWanlsZVN5YVNpc0RqUEpzNUozZWRvbVlDd2VSZVpzYUpQZ2s1dTcyX0JmZFB0UWtqeFhtNDE0bTFQU0pqZFBmUW44V0dEemZKRGREeHh6c1JKaCUyNTI2c2FpJTI1M0RBTWZsLVlUSlpPS29yNFROSEdqanpxNTY0LUxjc2FVTFQ4dS0xQ1pqQ20tak04OGxMQlBEZDljQmdjbGZSRklibFlJdV9UdGFueGNjY0pwYXlZN2FUUmF4aWJySHpyOVlCT2ZPRjBYTzRiaHYzVFE3JTI1MjZzaWclMjUzRENnMEFyS0pTekxXaDdJQzBiZFhkRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABANgCAOACn_A_6gIWaHR0cHM6Ly93aGVyZWdvZXMuY29tL_ICDAoGSEVJR0hUEgI5MPICDAoFV0lEVEgSAzcyOPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICFwoKSUZSQU1FX0tFWRIJOTcyNTczNzc38gK_FQoLUFJFX1NDUklQVFMSrxU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBoPXRoaXN8fHNlbGY7LyoKCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aDtkKyspaWYoZCBpbiBhJiZhW2RdPT09YylyZXR1cm4gZDtyZXR1cm4tMX07ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW4lWZAgcChhLGMsZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhVhoAeD1bXSk7dmFyIGI9bihhLmRvY3VtZW50KTtpZihkKXsBGghlPWYxggQpexkXBGY9Wm0AbCxnPWsoZixiKTswPD1nJiZBcnJheS5wcm90b3Qh6qhzcGxpY2UuY2FsbChmLGcsMSl9Yi5yZW1vdmVFdmVudExpc3RlbmVyJiZiThcANCgibG9hZCIsZSwhMSk7tjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAQmJkZIAAAoNmoAHGIuc3JjPWM7WjEBJC5wdXNoKGIpfTsxaQggcSgpfARhPTGS8E8uY3VycmVudFNjcmlwdDtyZXR1cm4oYT12b2lkIDA9PT1hP251bGw6YSkmJiI3NyI9PT1hLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6ZC3pRC5xdWVyeVNlbGVjdG9yKCdbZAklID0iNzciXScpfUUd8FJyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdW5jdGlvbiB0KBHgAGgFYQxjPVtdBQkEZD0Bxgw7ZG97QXsYYj1hO3RyeQUMAGVBkxhlPSEhYiYmASQcIT1iLmxvY2GhFCAuaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AV4IZj1lGRcAZgEWDGlmKGYJmQBnPl4ADDtkPWJ1HyH0NZkkcmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_ZH19d2hpbGUoYSYmYiE9YSk7Yj0wO2Zvcihhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1oISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwAHC5sZW5ndGg9HXUAKQmGEDE7YTxjDR9MOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBoGash1WXlAGclFiUCBGQ9MgQBIDA8PWQ7LS1kKSG6RD1jW2RdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBkFeYEJiYBzAE7BDswQWUlWggmJmQFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfXXQAHahoRwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCp0pAHeVKXx0KCksYz1hLmluZGV4T2YoIj8iKTtzZXRUaW1lb3V0KBGMDTEAZJk6GGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsEYi5SawQ4LXJjZCIpPyJwYWdlYWQyzYMQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGU9KGUBsQwpJiZlWpkADTEwIil8fCJ1bmtub3duImHjXCtlKyImc2FtcGxlPSIrZDtiPXdpbmRvdwVYAGY5NBRmPyExOmYhMzRlPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGU9L0Nocm9tZS9JmyBlKSYmIS9FZGcZERw_ITA6ITE7ZWGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGQpOnAoYixkLNUMCZ4QKX19LDBVoFwwPD1jP2Euc3Vic3RyaW5nKDAsYyk6YX0J4AwucmZsLugHyWBsIGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtRGNCWE5CMFlNdjZVVmNsUks1a2xBSzcxaXFkLXR5b2p3dUszSjFNVmN6a0FqbTJ0RGpfaVZ1LTdyYmpZQVY3VG5fUU1US1pXLVRPa28zbUNvZjdaVW8zUE5nNUEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqoZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDUklQVFMSiAE8cyVqNggBFvYJFGFkcy5nLjo_DzEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMAPp0kYCB7cjNweCgnOTcyNTczNzc3Jyk7fSkoKTs96hCkEgoQSAGdNFBPUlRfUEFSQU1TEo8SkSOKlADwfWFkZmV0Y2g_YWRrPTE4MzI0OTQxMTMmYWRzYWZlPW1lZGl1bSZjbGllbnQ9Y2EtcHViLTMwNzY4OTAwMTI3NDE0NjcmZm9ybWF0PTcyOHg5MF9hcyZpcD0yMTcuMTE0LjIxOC4yNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wb0mLIF9zdGFydD0xJqF2Ebwgd2hlcmVnb2VzRUgQJnN1Yl8NhwBiQY3wfXItMzA1NjQ0NyZobD1kZSZhY2VpZD1NUDhidEFENVZUUUJMMk0wQVE1b05BSDVjRFFCd0hVMEFRMTROQUdiZURRQjlIbzBBUWw3TkFHY2V6UUJ2SHMwQWNWN05BSHBlelFCN0hzMEFSeDhOQUV0ZkRRQkxudzBBVDU4TkFGRgEQLFVYdzBBVnQ4TkFGZQEQGFgzdzBBV0YBEAB1ARAsZW53MEFYMThOQUdCARAAZwEQBFlWARAAUAEQAG4BEARhOQEQADABEAB0AVAEYmQBEABfARD0dglTM05CQVZOelFRSDhFTm9CaWgxY0FzMGVYQUxEOG0wQ2NfdUlBaWRDcWdJb1Fxb0NLMEtxQW41aXFnSVNhS29DOEhhcUFoV0VxZ0tBbTZvQ2dadXFBb0ticWdLaXFLb0NZcXlxQXR6SXFnSjh6YW9DaHMycUFuWGFxZ0o4M2FvQ1ZkNnFBc25pcWdLZzVhb0NVT3VxQWwzdXFnS2w3cW9DY2ZHcUFyX3hxZ0pPOHFvQ1dQS3FBb3YwcWdLWDlLb0M5UFdxQWxiNHFnSUktNm9DSnZ1cUFrTDdxZ0pKX2FvQzl3V3JBbGNHcXdJRUI2c0N6UWVyQWtjSXF3SnZDYXNDalFtckF0c05xd0w1RWFzQ1p4S3JBcmdUcXdJb0ZLc0NhUmFyQWxzWXF3S3lHS3NDOUJpckFvUWFxd0o5RzZzQ29SeXJBcVFkcXdLQUhxc0NfaDZyQXNvZnF3S2FJS3NDd2lDckFzWWdxd0pGSWFzQ2RpR3JBb2NpcXdLWklxc0NRaU9yQWg4a3F3SWhKS3NDMXlTckFpZ2xxd0pWSmFzQ3dXd2tCTXFvaEFYS3M4VUZab3FORVBhUi14SUtxUHNTMUt6N0VuX3EteEtUNnZzU3N2cjdFdHY2LXhJRy1fc1N5X3o3RXRyOC14S09fX3NTV3dIOEVtQUJfQkpvb3VvVTkxWnJHdW0xdldsR0d3ZHEmZXhrPTk3MjU3Mzc3NyZhd2JpZF9jPUFLQW1mLUR1MEtOSkE0Nkl6VndDMXJHV1c0dDhrZUVhSkFkb1FYTWx1Y3VidEg2TU84MnBpbnBqMlV1RjB1bXJLZEExdEU5MkwxUnpEdUZmTEowOUhpaVFuUzhUTmFQU3dmZzFtcDZTSkU0S3Y2X2tTV2I1YUlsTEhjbEYtclBIWXZPN1Y1SW5aWmlEQW9YcXh5WjZQVmRlQkNDMTVISl96eWN3TVRWRHlNUl9za2FtZE9GV09VSSZhd2JpZF9kPUFLQW1mLURQVm8xRWliRzA4VTZYdzhUbzlmbDBoNUNoMjM1Tl9VYTVRY0hXTHNVLW5zeHoyNE9oRGVQNEU2V00wZUQ3b1JuWkdWUmUwYjhFUzNKaFZCWTlRYTZsSXFETXE3MThLRXdXN2JWVjZURHNHbVdRTi1sUEhIZkM4U3NOcXdGVUJHRlNKcGkyd0dyME5rZmVTQWxNNTRyT1o1ZHBnM2Nyby1hUEI0T1hTVnhueEg4UlJITDFFRGZSU2N1NnRXRDE4V2JTTVJBMnU1aDdZSkFBbEtKNGdTUXN1ZWc2NVlibHBoQXpGSFlMWTI2aF96UkVyM2R3MUFvbEZTRkl3ZzlWYTN3ZExQdVE1VERqU3lvWUVUb210SHNLVC1CaG9kOXhzdXY1RFFFdWxNOFZraHRXZHc1cFhKaHJ1Zy1oS2hlSTBFV1AyRFNiM2daZDNLSDU1M3Q2TGdPMkNfdGI3TWtnUEpxUXg2dmxUal9lM2c2MnJ4UHczZEplaWtGRVFuY1BHZDB5bHJnUXo4bnBjWFBVYzVRX3JOSEZZMVYwZTFsajZsazN6czN4UklsRmNCT04yOGxOa1pMYnJsc21ZWDdVcnROQkdkMEFjb3Fxa1h5R0tBcmw1SG9sUTJxc0R3Z3J2SE52X2ZOQjYwVWFTNVpoNUpZbHd6YzZSd1RBMW83RmxNRzFVMXBBUkpCdUF2WXJHcVNHallXTjRiQWFSUThTVFg1NlI2QWI4eVljYm5Td0lSZXFodHRLd3A3TWJMbkRiMmhNNS1xTUdDY3h0YzJYQ29MOENlaER4eE9JZl9HTkI4WWJmUEhZUl95alNpRVRsVW1zT0pMWXpGY3AyRDR4bzdUNU85OFMySDBIendqOHNLZFJ6eXZTd1lZa0VMS2EtX3F0a1hObjFGOWNzay1sQWpwXzktTjVOekliLWJ3N1B6YldWMk1OcmNVaFJJb3k4cVZnQ0lpSEtReTl2T1JiYlVHZ2tiZWVwX1E4aWo1MlBnenRFQ2o2WVZGOEZwQTZLd3VuN0Qxb19OYzhJcnhyZ3lCWHJJSm9iQWRtelA2VHRmVGxNS1Vpb3I1aXhHT25PdTNRU3VkcThnLS1OTDBxZmFYOGVzNW83UHB6VUlEQ1VVU2hnTXV1dlExM3JGX3VTS2hTb212Wkg0ZTExajJoRjdwOEd6QlU1Wng5LVJTM2FEZ0xod053ZS0ybzdpRGY2M2RUb3JXN2xLNHFrZ3R2c3hZUkxSWEpYdVQyeUJXR1N1cWg3ckZlVUdNV1BVQklkb3ZtbTZ1WWJ3UDBjNGcxQk1aWkpRc3FFM3c0MFlSQUhZa040UWlQQ1FXNWR3ajhzQmV1SDk1MHdwdXBQUzYwZTNTTVlXdm83SEphWF9yUGdCc0pSbzBncFVNMi1Fcy1nODg1TFVUUXVlVy1BS2R6eHFMZXk5dXhMTGlfRG1VektQRUtCanJXJmNpZD1DQUFTQk9Sb3dmZyZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUJxV281LVpkSVJNX29aWnVXY0w1UW5RRTBkU0JWaTR1TzJHTm5DN00tWjVFSHFiM29FT083MzZ0ODB2SVkxREZ2bm1kY0VfLURMNXV4MXlBdHJHczZUdkNXb0lnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzY2ODYzMTc4NDI0OTMwMjMyNzAiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4yMTcuMTE0LjIxOC4yNKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8ASnossliAUBmAUAoAWKn-mDkrOMlhbABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWF-A_6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM2NDgxNzAxNDA3ugcPCAAQABgAIAAwADi9BkAAyAcA0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=fb942be264e731b2e2e50e4b3086420250232675

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1179012802&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsu3myDJJQWyVavVpKXCU2nf6JgPbv8qCLljZJ2aSiQPPtHEernCKxfWI1KflkB2CWQdDBDS9Yfq2kGhC4-jf4kGIrKueuD0sfGomXHIFXK0ca4OT6FZq7kWPFESXdQVCpNtwv_dePV7prql63DKvl_XYoQkqtQsD60SjeRr-fA5SScVz76E4WG5Dia3R256lqPGtjr0r7vI59JnJDyWrHDYOzojeRSKwQ_cS1vnBv39pg5m8bbLtmmmU_SWcyVlf2kmRgVu-lxgyFKgDVjyleSyaSisDjPJs5J3edomYCweReZsaJPgk5u72_BfdPtQkjxXm414m1PSJjdPfQn8WGDzfJDdDxxzsRJh%2526sai%253DAMfl-YTJZOKor4TNHGjjzq564-LcsaULT8u-1CZjCm-jM88lLBPDd9cBgclfRFIblYIu_TtanxcccJpayY7aTRaxibrHzr9YBOfOF0XO4bhv3TQ7%2526sig%253DCg0ArKJSzLWh7IC0bdXdEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

fbcc7b327d09e9422ffb6ba3b87390166042d28b39add07cd17cb54f710981a0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

AN-X-Request-Uuid: 457da431-0bbe-4c83-b126-1b097c215fd3
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Thu, 11 Aug 2022 07:00:31 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Creative-ID: 78827815
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame E40E 52 KB
17 KB 54ms
20ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=1179012802&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsu3myDJJQWyVavVpKXCU2nf6JgPbv8qCLljZJ2aSiQPPtHEernCKxfWI1KflkB2CWQdDBDS9Yfq2kGhC4-jf4kGIrKueuD0sfGomXHIFXK0ca4OT6FZq7kWPFESXdQVCpNtwv_dePV7prql63DKvl_XYoQkqtQsD60SjeRr-fA5SScVz76E4WG5Dia3R256lqPGtjr0r7vI59JnJDyWrHDYOzojeRSKwQ_cS1vnBv39pg5m8bbLtmmmU_SWcyVlf2kmRgVu-lxgyFKgDVjyleSyaSisDjPJs5J3edomYCweReZsaJPgk5u72_BfdPtQkjxXm414m1PSJjdPfQn8WGDzfJDdDxxzsRJh%2526sai%253DAMfl-YTJZOKor4TNHGjjzq564-LcsaULT8u-1CZjCm-jM88lLBPDd9cBgclfRFIblYIu_TtanxcccJpayY7aTRaxibrHzr9YBOfOF0XO4bhv3TQ7%2526sig%253DCg0ArKJSzLWh7IC0bdXdEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 8345
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 11 Aug 2022 07:00:31 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 03 Aug 2022 04:41:10 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 218105, 133623
X-Served-By: cache-lga21969-LGA, cache-hhn4050-HHN
X-Timer: S1660201231.129916,VS0,VE0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 50A3 0
0 58ms
58ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvh41xRtx3MlPqv4VJg7BhyU2bjgPLQlCNsmjapyZ6ADpcn97GhpbNzPPGQ4ENyZWLEVuTf-nENX5ugrEvBA721jk1crRNcuy99HCZaQyMWPXF8GmcbYDvldFDFQET1sI8OxsXTayXre8S-T-igqxXgadvA6Cta4eKFD0hZ5anWRrmhulSaugPd6OIwr-P5XNpA4GqddomKiUY5SsyZm0Q40ZHjWa8rQWKujw9KBLElvlVW0GhhtnHPlyQ5Yd5ukyV7aA0Bka3o7iOiqaTnfs1BJxANhIE5T2T0GY040L4cS5m1dq5bhKV_3zhgCX8eupwDjgnz6xKBPu7H8LSZWC8F-_1uZl0NegjtMMnzjQ4&sai=AMfl-YRn8OadfCWikf3WkDx067gQSSnv2k4BWc7ON3Ljd8ja_fLX8wKYa51KeVXxNupcQU8T5CGspRHzsHZplceTQx2o1iPKth1hcEfMCRfWKsma&sig=Cg0ArKJSzKsdT1yGMbw_EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 11 Aug 2022 07:00:31 GMT

GET
DATA 200
OK truncated
/ Frame 50A3 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 594a398c276bee39d18e24ab7c6cad788d6d9a12800a8b5bab281595a6ad26cc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D247 143 B
163 B 19ms
18ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1279
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Thu, 11 Aug 2022 06:39:12 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E090 0
20 B 53ms
52ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-DcBXNB0YMv6UVclRK5klAK71iqd-tyojwuK3J1MVczkAjm2tDj_iVu-7rbjYAV7Tn_QMTKZW-TOko3mCof7ZUo3PNg5A

Requested by

Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLAN_BMwBsAAAMA1gAFAQiO0tKXBhCmyJyJ79Sk5VwY8rObmYX_t-B9KjYJjSYXY2Adpz8R6lxRSghWoT8ZAAAAgOtR2D8h6lxRSghWoT8pjSYJJMgxAAAA4FG4nj8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvBAmAHYBaABWqgBAbABALgBAsABBcgBAtABANgBAOABAOoBkQVodHRwcyUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGUJDixuZXQlMkZwY3MlMkYFEhwlMjUzRnhhaQEI9AIFREFLQU9qc3UzbXlESkpRV3lWYXZWcEtYQ1UybmY2SmdQYnY4cUNMbGpaSjJhU2lRUFB0SEVlcm5DS3hmV0kxS2Zsa0IyQ1dRZERCRFM5WWZxMmtHaEM0LWpmNGtHSXJLdWV1RDBzZkdvbVhISUZYSzBjYTRPVDZGWnE3a1dQRkVTWGRRVkNwTnR3dl9kZVBWN3BycWw2M0RLdmxfWFlvUWtxdFFzRDYwU2plUnItZkE1U1NjVno3NkU0V0c1RGlhM1IyNTZscVBHdGpyMHI3dkk1OUpuSkR5V3JIRFlPem9qZVJTS3dRX2NTMXZuQnYzOXBnNW04YmJMdG1tbVVfU1djeVZsZjJrbVJnVnUtbHhneUZLZ0RWanlsZVN5YVNpc0RqUEpzNUozZWRvbVlDd2VSZVpzYUpQZ2s1dTcyX0JmZFB0UWtqeFhtNDE0bTFQU0pqZFBmUW44V0dEemZKRGREeHh6c1JKaCUyNTI2c2FpJTI1M0RBTWZsLVlUSlpPS29yNFROSEdqanpxNTY0LUxjc2FVTFQ4dS0xQ1pqQ20tak04OGxMQlBEZDljQmdjbGZSRklibFlJdV9UdGFueGNjY0pwYXlZN2FUUmF4aWJySHpyOVlCT2ZPRjBYTzRiaHYzVFE3JTI1MjZzaWclMjUzRENnMEFyS0pTekxXaDdJQzBiZFhkRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABANgCAOACn_A_6gIWaHR0cHM6Ly93aGVyZWdvZXMuY29tL_ICDAoGSEVJR0hUEgI5MPICDAoFV0lEVEgSAzcyOPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICFwoKSUZSQU1FX0tFWRIJOTcyNTczNzc38gK_FQoLUFJFX1NDUklQVFMSrxU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBoPXRoaXN8fHNlbGY7LyoKCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aDtkKyspaWYoZCBpbiBhJiZhW2RdPT09YylyZXR1cm4gZDtyZXR1cm4tMX07ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW4lWZAgcChhLGMsZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhVhoAeD1bXSk7dmFyIGI9bihhLmRvY3VtZW50KTtpZihkKXsBGghlPWYxggQpexkXBGY9Wm0AbCxnPWsoZixiKTswPD1nJiZBcnJheS5wcm90b3Qh6qhzcGxpY2UuY2FsbChmLGcsMSl9Yi5yZW1vdmVFdmVudExpc3RlbmVyJiZiThcANCgibG9hZCIsZSwhMSk7tjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAQmJkZIAAAoNmoAHGIuc3JjPWM7WjEBJC5wdXNoKGIpfTsxaQggcSgpfARhPTGS8E8uY3VycmVudFNjcmlwdDtyZXR1cm4oYT12b2lkIDA9PT1hP251bGw6YSkmJiI3NyI9PT1hLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6ZC3pRC5xdWVyeVNlbGVjdG9yKCdbZAklID0iNzciXScpfUUd8FJyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdW5jdGlvbiB0KBHgAGgFYQxjPVtdBQkEZD0Bxgw7ZG97QXsYYj1hO3RyeQUMAGVBkxhlPSEhYiYmASQcIT1iLmxvY2GhFCAuaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AV4IZj1lGRcAZgEWDGlmKGYJmQBnPl4ADDtkPWJ1HyH0NZkkcmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_ZH19d2hpbGUoYSYmYiE9YSk7Yj0wO2Zvcihhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1oISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwAHC5sZW5ndGg9HXUAKQmGEDE7YTxjDR9MOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBoGash1WXlAGclFiUCBGQ9MgQBIDA8PWQ7LS1kKSG6RD1jW2RdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBkFeYEJiYBzAE7BDswQWUlWggmJmQFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfXXQAHahoRwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCp0pAHeVKXx0KCksYz1hLmluZGV4T2YoIj8iKTtzZXRUaW1lb3V0KBGMDTEAZJk6GGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsEYi5SawQ4LXJjZCIpPyJwYWdlYWQyzYMQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGU9KGUBsQwpJiZlWpkADTEwIil8fCJ1bmtub3duImHjXCtlKyImc2FtcGxlPSIrZDtiPXdpbmRvdwVYAGY5NBRmPyExOmYhMzRlPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGU9L0Nocm9tZS9JmyBlKSYmIS9FZGcZERw_ITA6ITE7ZWGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGQpOnAoYixkLNUMCZ4QKX19LDBVoFwwPD1jP2Euc3Vic3RyaW5nKDAsYyk6YX0J4AwucmZsLugHyWBsIGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtRGNCWE5CMFlNdjZVVmNsUks1a2xBSzcxaXFkLXR5b2p3dUszSjFNVmN6a0FqbTJ0RGpfaVZ1LTdyYmpZQVY3VG5fUU1US1pXLVRPa28zbUNvZjdaVW8zUE5nNUEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqoZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDUklQVFMSiAE8cyVqNggBFvYJFGFkcy5nLjo_DzEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMAPp0kYCB7cjNweCgnOTcyNTczNzc3Jyk7fSkoKTs96hCkEgoQSAGdNFBPUlRfUEFSQU1TEo8SkSOKlADwfWFkZmV0Y2g_YWRrPTE4MzI0OTQxMTMmYWRzYWZlPW1lZGl1bSZjbGllbnQ9Y2EtcHViLTMwNzY4OTAwMTI3NDE0NjcmZm9ybWF0PTcyOHg5MF9hcyZpcD0yMTcuMTE0LjIxOC4yNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wb0mLIF9zdGFydD0xJqF2Ebwgd2hlcmVnb2VzRUgQJnN1Yl8NhwBiQY3wfXItMzA1NjQ0NyZobD1kZSZhY2VpZD1NUDhidEFENVZUUUJMMk0wQVE1b05BSDVjRFFCd0hVMEFRMTROQUdiZURRQjlIbzBBUWw3TkFHY2V6UUJ2SHMwQWNWN05BSHBlelFCN0hzMEFSeDhOQUV0ZkRRQkxudzBBVDU4TkFGRgEQLFVYdzBBVnQ4TkFGZQEQGFgzdzBBV0YBEAB1ARAsZW53MEFYMThOQUdCARAAZwEQBFlWARAAUAEQAG4BEARhOQEQADABEAB0AVAEYmQBEABfARD0dglTM05CQVZOelFRSDhFTm9CaWgxY0FzMGVYQUxEOG0wQ2NfdUlBaWRDcWdJb1Fxb0NLMEtxQW41aXFnSVNhS29DOEhhcUFoV0VxZ0tBbTZvQ2dadXFBb0ticWdLaXFLb0NZcXlxQXR6SXFnSjh6YW9DaHMycUFuWGFxZ0o4M2FvQ1ZkNnFBc25pcWdLZzVhb0NVT3VxQWwzdXFnS2w3cW9DY2ZHcUFyX3hxZ0pPOHFvQ1dQS3FBb3YwcWdLWDlLb0M5UFdxQWxiNHFnSUktNm9DSnZ1cUFrTDdxZ0pKX2FvQzl3V3JBbGNHcXdJRUI2c0N6UWVyQWtjSXF3SnZDYXNDalFtckF0c05xd0w1RWFzQ1p4S3JBcmdUcXdJb0ZLc0NhUmFyQWxzWXF3S3lHS3NDOUJpckFvUWFxd0o5RzZzQ29SeXJBcVFkcXdLQUhxc0NfaDZyQXNvZnF3S2FJS3NDd2lDckFzWWdxd0pGSWFzQ2RpR3JBb2NpcXdLWklxc0NRaU9yQWg4a3F3SWhKS3NDMXlTckFpZ2xxd0pWSmFzQ3dXd2tCTXFvaEFYS3M4VUZab3FORVBhUi14SUtxUHNTMUt6N0VuX3EteEtUNnZzU3N2cjdFdHY2LXhJRy1fc1N5X3o3RXRyOC14S09fX3NTV3dIOEVtQUJfQkpvb3VvVTkxWnJHdW0xdldsR0d3ZHEmZXhrPTk3MjU3Mzc3NyZhd2JpZF9jPUFLQW1mLUR1MEtOSkE0Nkl6VndDMXJHV1c0dDhrZUVhSkFkb1FYTWx1Y3VidEg2TU84MnBpbnBqMlV1RjB1bXJLZEExdEU5MkwxUnpEdUZmTEowOUhpaVFuUzhUTmFQU3dmZzFtcDZTSkU0S3Y2X2tTV2I1YUlsTEhjbEYtclBIWXZPN1Y1SW5aWmlEQW9YcXh5WjZQVmRlQkNDMTVISl96eWN3TVRWRHlNUl9za2FtZE9GV09VSSZhd2JpZF9kPUFLQW1mLURQVm8xRWliRzA4VTZYdzhUbzlmbDBoNUNoMjM1Tl9VYTVRY0hXTHNVLW5zeHoyNE9oRGVQNEU2V00wZUQ3b1JuWkdWUmUwYjhFUzNKaFZCWTlRYTZsSXFETXE3MThLRXdXN2JWVjZURHNHbVdRTi1sUEhIZkM4U3NOcXdGVUJHRlNKcGkyd0dyME5rZmVTQWxNNTRyT1o1ZHBnM2Nyby1hUEI0T1hTVnhueEg4UlJITDFFRGZSU2N1NnRXRDE4V2JTTVJBMnU1aDdZSkFBbEtKNGdTUXN1ZWc2NVlibHBoQXpGSFlMWTI2aF96UkVyM2R3MUFvbEZTRkl3ZzlWYTN3ZExQdVE1VERqU3lvWUVUb210SHNLVC1CaG9kOXhzdXY1RFFFdWxNOFZraHRXZHc1cFhKaHJ1Zy1oS2hlSTBFV1AyRFNiM2daZDNLSDU1M3Q2TGdPMkNfdGI3TWtnUEpxUXg2dmxUal9lM2c2MnJ4UHczZEplaWtGRVFuY1BHZDB5bHJnUXo4bnBjWFBVYzVRX3JOSEZZMVYwZTFsajZsazN6czN4UklsRmNCT04yOGxOa1pMYnJsc21ZWDdVcnROQkdkMEFjb3Fxa1h5R0tBcmw1SG9sUTJxc0R3Z3J2SE52X2ZOQjYwVWFTNVpoNUpZbHd6YzZSd1RBMW83RmxNRzFVMXBBUkpCdUF2WXJHcVNHallXTjRiQWFSUThTVFg1NlI2QWI4eVljYm5Td0lSZXFodHRLd3A3TWJMbkRiMmhNNS1xTUdDY3h0YzJYQ29MOENlaER4eE9JZl9HTkI4WWJmUEhZUl95alNpRVRsVW1zT0pMWXpGY3AyRDR4bzdUNU85OFMySDBIendqOHNLZFJ6eXZTd1lZa0VMS2EtX3F0a1hObjFGOWNzay1sQWpwXzktTjVOekliLWJ3N1B6YldWMk1OcmNVaFJJb3k4cVZnQ0lpSEtReTl2T1JiYlVHZ2tiZWVwX1E4aWo1MlBnenRFQ2o2WVZGOEZwQTZLd3VuN0Qxb19OYzhJcnhyZ3lCWHJJSm9iQWRtelA2VHRmVGxNS1Vpb3I1aXhHT25PdTNRU3VkcThnLS1OTDBxZmFYOGVzNW83UHB6VUlEQ1VVU2hnTXV1dlExM3JGX3VTS2hTb212Wkg0ZTExajJoRjdwOEd6QlU1Wng5LVJTM2FEZ0xod053ZS0ybzdpRGY2M2RUb3JXN2xLNHFrZ3R2c3hZUkxSWEpYdVQyeUJXR1N1cWg3ckZlVUdNV1BVQklkb3ZtbTZ1WWJ3UDBjNGcxQk1aWkpRc3FFM3c0MFlSQUhZa040UWlQQ1FXNWR3ajhzQmV1SDk1MHdwdXBQUzYwZTNTTVlXdm83SEphWF9yUGdCc0pSbzBncFVNMi1Fcy1nODg1TFVUUXVlVy1BS2R6eHFMZXk5dXhMTGlfRG1VektQRUtCanJXJmNpZD1DQUFTQk9Sb3dmZyZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUJxV281LVpkSVJNX29aWnVXY0w1UW5RRTBkU0JWaTR1TzJHTm5DN00tWjVFSHFiM29FT083MzZ0ODB2SVkxREZ2bm1kY0VfLURMNXV4MXlBdHJHczZUdkNXb0lnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzY2ODYzMTc4NDI0OTMwMjMyNzAiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4yMTcuMTE0LjIxOC4yNKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8ASnossliAUBmAUAoAWKn-mDkrOMlhbABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWF-A_6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM2NDgxNzAxNDA3ugcPCAAQABgAIAAwADi9BkAAyAcA0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=fb942be264e731b2e2e50e4b3086420250232675

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame E090 11 KB
5 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05fdf9059f82368fa058a4fed88c9b56263934d770af68ea301f57f80be88ca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:30:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1808
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4665
x-xss-protection: 0
server: cafe
etag: 1690156577369591742
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 11 Aug 2022 07:30:23 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame E090 0
817 B 20ms
19ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKPC_BMjwUAAAMA1gAFAQiO0tKXBhCmyJyJ79Sk5VwY8rObmYX_t-B9KjYJjSYXY2Adpz8R6lxRSghWoT8ZAAAAgOtR2D8h6lxRSghWoT8pjSYJJMgxAAAA4FG4nj8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvBAmAHYBaABWqgBA7ABALgBAcABBcgBAtABANgBAOABAOoBkQVodHRwcyUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGUJDixuZXQlMkZwY3MlMkYFEhwlMjUzRnhhaQEI9KAEREFLQU9qc3UzbXlESkpRV3lWYXZWcEtYQ1UybmY2SmdQYnY4cUNMbGpaSjJhU2lRUFB0SEVlcm5DS3hmV0kxS2Zsa0IyQ1dRZERCRFM5WWZxMmtHaEM0LWpmNGtHSXJLdWV1RDBzZkdvbVhISUZYSzBjYTRPVDZGWnE3a1dQRkVTWGRRVkNwTnR3dl9kZVBWN3BycWw2M0RLdmxfWFlvUWtxdFFzRDYwU2plUnItZkE1U1NjVno3NkU0V0c1RGlhM1IyNTZscVBHdGpyMHI3dkk1OUpuSkR5V3JIRFlPem9qZVJTS3dRX2NTMXZuQnYzOXBnNW04YmJMdG1tbVVfU1djeVZsZjJrbVJnVnUtbHhneUZLZ0RWanlsZVN5YVNpc0RqUEpzNUozZWRvbVlDd2VSZVpzYUpQZ2s1dTcyX0JmZFB0UWtqeFhtNDE0bTFQU0pqZFBmUW44V0dEemZKRGREeHh6c1JKaCUyNTI2c2FpJTI1M0RBTWZsLVlUSlpPS29yNFROSEdqanpxNTY0LUxjc2FVTFQ4dS0xQ1pqQ20tak04OGxMQlBEZDljQmdjbGZSRklibFlJdV9UdGFueGNjY0pwYXlZN2FUUmF4aWJySHpyOVlCT2ZPRjBYTzRiaHYzVFE3JTI1MjZzaWclMjUzRENnMEFyS0pTekxXaDdJQzBiZFhkRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABANgCAOACn_A_6gIWaHR0cHM6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6gEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmF3YmlkX2I9QUtBbWYtQnFXbzUtWmRJUk1fb1padVdjTDVRblFFMGRTQlZpNHVPMkdObkM3TS1aNUVIcWIzb0VPTzczNnQ4MHZJWTFERnZubWRjRV8tREw1dXgxeUF0ckdzNlR2Q1dvSWcmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNjY4NjMxNzg0MjQ5MzAyMzI3MCIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDjIxNy4xMTQuMjE4LjI0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBYqf6YOSs4yWFsAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBYX4D_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzY0ODE3MDE0MDe6Bw8IABAAGAAgADAAOL0GQADIBwDSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB9LRAYoIAhAAlQgAAIA_mAgB&s=31744d9be76d0a2cb5882c700ac9b0ccd26912c6

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7089f0a8-c589-46d4-9fda-4c5cf753aacd
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame E090 85 KB
29 KB 29ms
28ms Script
application/x-javascript 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLAN_BMwBsAAAMA1gAFAQiO0tKXBhCmyJyJ79Sk5VwY8rObmYX_t-B9KjYJjSYXY2Adpz8R6lxRSghWoT8ZAAAAgOtR2D8h6lxRSghWoT8pjSYJJMgxAAAA4FG4nj8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvBAmAHYBaABWqgBAbABALgBAsABBcgBAtABANgBAOABAOoBkQVodHRwcyUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGUJDixuZXQlMkZwY3MlMkYFEhwlMjUzRnhhaQEI9AIFREFLQU9qc3UzbXlESkpRV3lWYXZWcEtYQ1UybmY2SmdQYnY4cUNMbGpaSjJhU2lRUFB0SEVlcm5DS3hmV0kxS2Zsa0IyQ1dRZERCRFM5WWZxMmtHaEM0LWpmNGtHSXJLdWV1RDBzZkdvbVhISUZYSzBjYTRPVDZGWnE3a1dQRkVTWGRRVkNwTnR3dl9kZVBWN3BycWw2M0RLdmxfWFlvUWtxdFFzRDYwU2plUnItZkE1U1NjVno3NkU0V0c1RGlhM1IyNTZscVBHdGpyMHI3dkk1OUpuSkR5V3JIRFlPem9qZVJTS3dRX2NTMXZuQnYzOXBnNW04YmJMdG1tbVVfU1djeVZsZjJrbVJnVnUtbHhneUZLZ0RWanlsZVN5YVNpc0RqUEpzNUozZWRvbVlDd2VSZVpzYUpQZ2s1dTcyX0JmZFB0UWtqeFhtNDE0bTFQU0pqZFBmUW44V0dEemZKRGREeHh6c1JKaCUyNTI2c2FpJTI1M0RBTWZsLVlUSlpPS29yNFROSEdqanpxNTY0LUxjc2FVTFQ4dS0xQ1pqQ20tak04OGxMQlBEZDljQmdjbGZSRklibFlJdV9UdGFueGNjY0pwYXlZN2FUUmF4aWJySHpyOVlCT2ZPRjBYTzRiaHYzVFE3JTI1MjZzaWclMjUzRENnMEFyS0pTekxXaDdJQzBiZFhkRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABANgCAOACn_A_6gIWaHR0cHM6Ly93aGVyZWdvZXMuY29tL_ICDAoGSEVJR0hUEgI5MPICDAoFV0lEVEgSAzcyOPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICFwoKSUZSQU1FX0tFWRIJOTcyNTczNzc38gK_FQoLUFJFX1NDUklQVFMSrxU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBoPXRoaXN8fHNlbGY7LyoKCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhLmxlbmd0aDtkKyspaWYoZCBpbiBhJiZhW2RdPT09YylyZXR1cm4gZDtyZXR1cm4tMX07ZnVuY3Rpb24gbChhKXtsWyIgIl0oYSk7cmV0dXJuIGF9bFsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW4lWZAgcChhLGMsZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhVhoAeD1bXSk7dmFyIGI9bihhLmRvY3VtZW50KTtpZihkKXsBGghlPWYxggQpexkXBGY9Wm0AbCxnPWsoZixiKTswPD1nJiZBcnJheS5wcm90b3Qh6qhzcGxpY2UuY2FsbChmLGcsMSl9Yi5yZW1vdmVFdmVudExpc3RlbmVyJiZiThcANCgibG9hZCIsZSwhMSk7tjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAQmJkZIAAAoNmoAHGIuc3JjPWM7WjEBJC5wdXNoKGIpfTsxaQggcSgpfARhPTGS8E8uY3VycmVudFNjcmlwdDtyZXR1cm4oYT12b2lkIDA9PT1hP251bGw6YSkmJiI3NyI9PT1hLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6ZC3pRC5xdWVyeVNlbGVjdG9yKCdbZAklID0iNzciXScpfUUd8FJyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdW5jdGlvbiB0KBHgAGgFYQxjPVtdBQkEZD0Bxgw7ZG97QXsYYj1hO3RyeQUMAGVBkxhlPSEhYiYmASQcIT1iLmxvY2GhFCAuaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AV4IZj1lGRcAZgEWDGlmKGYJmQBnPl4ADDtkPWJ1HyH0NZkkcmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_ZH19d2hpbGUoYSYmYiE9YSk7Yj0wO2Zvcihhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1oISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwAHC5sZW5ndGg9HXUAKQmGEDE7YTxjDR9MOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBoGash1WXlAGclFiUCBGQ9MgQBIDA8PWQ7LS1kKSG6RD1jW2RdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBkFeYEJiYBzAE7BDswQWUlWggmJmQFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfXXQAHahoRwpe3RoaXMuaUHVAQkIZz1jGSIAdR0iCHVybBEkFGg9ISFjOwUvBYglCp0pAHeVKXx0KCksYz1hLmluZGV4T2YoIj8iKTtzZXRUaW1lb3V0KBGMDTEAZJk6GGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsEYi5SawQ4LXJjZCIpPyJwYWdlYWQyzYMQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGU9KGUBsQwpJiZlWpkADTEwIil8fCJ1bmtub3duImHjXCtlKyImc2FtcGxlPSIrZDtiPXdpbmRvdwVYAGY5NBRmPyExOmYhMzRlPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGU9L0Nocm9tZS9JmyBlKSYmIS9FZGcZERw_ITA6ITE7ZWGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGQpOnAoYixkLNUMCZ4QKX19LDBVoFwwPD1jP2Euc3Vic3RyaW5nKDAsYyk6YX0J4AwucmZsLugHyWBsIGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtRGNCWE5CMFlNdjZVVmNsUks1a2xBSzcxaXFkLXR5b2p3dUszSjFNVmN6a0FqbTJ0RGpfaVZ1LTdyYmpZQVY3VG5fUU1US1pXLVRPa28zbUNvZjdaVW8zUE5nNUEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqoZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDUklQVFMSiAE8cyVqNggBFvYJFGFkcy5nLjo_DzEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMAPp0kYCB7cjNweCgnOTcyNTczNzc3Jyk7fSkoKTs96hCkEgoQSAGdNFBPUlRfUEFSQU1TEo8SkSOKlADwfWFkZmV0Y2g_YWRrPTE4MzI0OTQxMTMmYWRzYWZlPW1lZGl1bSZjbGllbnQ9Y2EtcHViLTMwNzY4OTAwMTI3NDE0NjcmZm9ybWF0PTcyOHg5MF9hcyZpcD0yMTcuMTE0LjIxOC4yNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wb0mLIF9zdGFydD0xJqF2Ebwgd2hlcmVnb2VzRUgQJnN1Yl8NhwBiQY3wfXItMzA1NjQ0NyZobD1kZSZhY2VpZD1NUDhidEFENVZUUUJMMk0wQVE1b05BSDVjRFFCd0hVMEFRMTROQUdiZURRQjlIbzBBUWw3TkFHY2V6UUJ2SHMwQWNWN05BSHBlelFCN0hzMEFSeDhOQUV0ZkRRQkxudzBBVDU4TkFGRgEQLFVYdzBBVnQ4TkFGZQEQGFgzdzBBV0YBEAB1ARAsZW53MEFYMThOQUdCARAAZwEQBFlWARAAUAEQAG4BEARhOQEQADABEAB0AVAEYmQBEABfARD0dglTM05CQVZOelFRSDhFTm9CaWgxY0FzMGVYQUxEOG0wQ2NfdUlBaWRDcWdJb1Fxb0NLMEtxQW41aXFnSVNhS29DOEhhcUFoV0VxZ0tBbTZvQ2dadXFBb0ticWdLaXFLb0NZcXlxQXR6SXFnSjh6YW9DaHMycUFuWGFxZ0o4M2FvQ1ZkNnFBc25pcWdLZzVhb0NVT3VxQWwzdXFnS2w3cW9DY2ZHcUFyX3hxZ0pPOHFvQ1dQS3FBb3YwcWdLWDlLb0M5UFdxQWxiNHFnSUktNm9DSnZ1cUFrTDdxZ0pKX2FvQzl3V3JBbGNHcXdJRUI2c0N6UWVyQWtjSXF3SnZDYXNDalFtckF0c05xd0w1RWFzQ1p4S3JBcmdUcXdJb0ZLc0NhUmFyQWxzWXF3S3lHS3NDOUJpckFvUWFxd0o5RzZzQ29SeXJBcVFkcXdLQUhxc0NfaDZyQXNvZnF3S2FJS3NDd2lDckFzWWdxd0pGSWFzQ2RpR3JBb2NpcXdLWklxc0NRaU9yQWg4a3F3SWhKS3NDMXlTckFpZ2xxd0pWSmFzQ3dXd2tCTXFvaEFYS3M4VUZab3FORVBhUi14SUtxUHNTMUt6N0VuX3EteEtUNnZzU3N2cjdFdHY2LXhJRy1fc1N5X3o3RXRyOC14S09fX3NTV3dIOEVtQUJfQkpvb3VvVTkxWnJHdW0xdldsR0d3ZHEmZXhrPTk3MjU3Mzc3NyZhd2JpZF9jPUFLQW1mLUR1MEtOSkE0Nkl6VndDMXJHV1c0dDhrZUVhSkFkb1FYTWx1Y3VidEg2TU84MnBpbnBqMlV1RjB1bXJLZEExdEU5MkwxUnpEdUZmTEowOUhpaVFuUzhUTmFQU3dmZzFtcDZTSkU0S3Y2X2tTV2I1YUlsTEhjbEYtclBIWXZPN1Y1SW5aWmlEQW9YcXh5WjZQVmRlQkNDMTVISl96eWN3TVRWRHlNUl9za2FtZE9GV09VSSZhd2JpZF9kPUFLQW1mLURQVm8xRWliRzA4VTZYdzhUbzlmbDBoNUNoMjM1Tl9VYTVRY0hXTHNVLW5zeHoyNE9oRGVQNEU2V00wZUQ3b1JuWkdWUmUwYjhFUzNKaFZCWTlRYTZsSXFETXE3MThLRXdXN2JWVjZURHNHbVdRTi1sUEhIZkM4U3NOcXdGVUJHRlNKcGkyd0dyME5rZmVTQWxNNTRyT1o1ZHBnM2Nyby1hUEI0T1hTVnhueEg4UlJITDFFRGZSU2N1NnRXRDE4V2JTTVJBMnU1aDdZSkFBbEtKNGdTUXN1ZWc2NVlibHBoQXpGSFlMWTI2aF96UkVyM2R3MUFvbEZTRkl3ZzlWYTN3ZExQdVE1VERqU3lvWUVUb210SHNLVC1CaG9kOXhzdXY1RFFFdWxNOFZraHRXZHc1cFhKaHJ1Zy1oS2hlSTBFV1AyRFNiM2daZDNLSDU1M3Q2TGdPMkNfdGI3TWtnUEpxUXg2dmxUal9lM2c2MnJ4UHczZEplaWtGRVFuY1BHZDB5bHJnUXo4bnBjWFBVYzVRX3JOSEZZMVYwZTFsajZsazN6czN4UklsRmNCT04yOGxOa1pMYnJsc21ZWDdVcnROQkdkMEFjb3Fxa1h5R0tBcmw1SG9sUTJxc0R3Z3J2SE52X2ZOQjYwVWFTNVpoNUpZbHd6YzZSd1RBMW83RmxNRzFVMXBBUkpCdUF2WXJHcVNHallXTjRiQWFSUThTVFg1NlI2QWI4eVljYm5Td0lSZXFodHRLd3A3TWJMbkRiMmhNNS1xTUdDY3h0YzJYQ29MOENlaER4eE9JZl9HTkI4WWJmUEhZUl95alNpRVRsVW1zT0pMWXpGY3AyRDR4bzdUNU85OFMySDBIendqOHNLZFJ6eXZTd1lZa0VMS2EtX3F0a1hObjFGOWNzay1sQWpwXzktTjVOekliLWJ3N1B6YldWMk1OcmNVaFJJb3k4cVZnQ0lpSEtReTl2T1JiYlVHZ2tiZWVwX1E4aWo1MlBnenRFQ2o2WVZGOEZwQTZLd3VuN0Qxb19OYzhJcnhyZ3lCWHJJSm9iQWRtelA2VHRmVGxNS1Vpb3I1aXhHT25PdTNRU3VkcThnLS1OTDBxZmFYOGVzNW83UHB6VUlEQ1VVU2hnTXV1dlExM3JGX3VTS2hTb212Wkg0ZTExajJoRjdwOEd6QlU1Wng5LVJTM2FEZ0xod053ZS0ybzdpRGY2M2RUb3JXN2xLNHFrZ3R2c3hZUkxSWEpYdVQyeUJXR1N1cWg3ckZlVUdNV1BVQklkb3ZtbTZ1WWJ3UDBjNGcxQk1aWkpRc3FFM3c0MFlSQUhZa040UWlQQ1FXNWR3ajhzQmV1SDk1MHdwdXBQUzYwZTNTTVlXdm83SEphWF9yUGdCc0pSbzBncFVNMi1Fcy1nODg1TFVUUXVlVy1BS2R6eHFMZXk5dXhMTGlfRG1VektQRUtCanJXJmNpZD1DQUFTQk9Sb3dmZyZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUJxV281LVpkSVJNX29aWnVXY0w1UW5RRTBkU0JWaTR1TzJHTm5DN00tWjVFSHFiM29FT083MzZ0ODB2SVkxREZ2bm1kY0VfLURMNXV4MXlBdHJHczZUdkNXb0lnJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzY2ODYzMTc4NDI0OTMwMjMyNzAiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4yMTcuMTE0LjIxOC4yNKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8ASnossliAUBmAUAoAWKn-mDkrOMlhbABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AWF-A_6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM2NDgxNzAxNDA3ugcPCAAQABgAIAAwADi9BkAAyAcA0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=fb942be264e731b2e2e50e4b3086420250232675
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:31 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29216
Expires: Fri, 11 Aug 2023 07:00:31 GMT

GET
DATA 200
OK truncated
/ Frame DD95 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 434ff4e1ea07b4121d5a7e442fb65c590a3fb992db2c6b05e141917f3ea38243

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 4F52 13 KB
5 KB 20ms
19ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fra1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3199
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 06:07:12 GMT
etag: 12223946614886178233
expires: Fri, 12 Aug 2022 06:07:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame C6BC 0
0 57ms
57ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsszVon-7fuDY1expBrif2y8hblOU0bO2q6CPmmZSF7Ou-XTsfmPSnIoLzSZAMt1W_ogHq03V6cepOUv4kHZw_1a46Pov0UHKSW5A3pi7UJDGMtRjxSlgxy6xnZqSk2T-2G-KrVnqIIqRvVcHjwyGA4uxLFUyaJKccecMydqhxPYsSBbmHjWloQA3czpkhbHOVssL2uAhITXK-cECABKK2MXU3EYcfuCwHLZ_vu7F9oxLvBxmD_zJ6F7SG6rkKCAgiRpNt6ycLRs6vkiqEkW_a6bZXQ2fYcXdfusy9Dr3gwVvNuLT9IJ7HdHlMrFB_Pv7VEMAeXMpvubK-nTC0TWz_sFwQ&sai=AMfl-YTn-QuqlNg0htWqYZV1-_3kBKIgKK7gxFA_HWtpCd2b8gNnkxwZsFVVoSrh077GyCuk6hpnMkZZvkoHbBXKbUNZUNNT6TEoENd3aazON-VU&sig=Cg0ArKJSzFxalZRkFW-5EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 11 Aug 2022 07:00:31 GMT

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame 32A1 4 KB
3 KB 21ms
20ms Script
application/javascript 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?id=9896220&psa=0&cb=225888887&gdpr=0&gdpr_consent=&loc=,&pubclick=https://fra1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAIA9Crc_AAAAAAAAAAAAAAAAAAAAALaJ1cLJ-sNB8tkmU_jfwH0OqfRiAAAAAGMBHQHKIAAA5QAAAAIAAAAEWWMDmKoUAAAAAAAAAAAAVVNEAHgAWAJrrgAAAAABAgEAAAAAAMwA0xbE-gAAAAA./bcr=AAAAAAAAAAA=/bn=93154/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=120x600&cb=836569151&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

eb443c1e19c4c231cb5cd368dbeaf2a76a614ac95cb75828ab8da2f0a0ac1943

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:31 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: f399b99e-5a26-4fb8-b03b-2344ff261450
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 32A1 0
817 B 21ms
21ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL_CKB_BAAAAwDWAAUBCI7S0pcGELaT1pac2f7hQRjys5uZhf-34H0qNgkAAAkCABEJBywAABkAAACAPQq3PyEREgApEQn0AgIxAAAAQOF6hD8w44L0CDjKQUDlAUgCUISyjRtYmNVSYABo69yaAXji1wWAAQGKAQCSAQNVU0SYAXigAdgEqAEBsAEAuAECwAEByAEA0AEA2AEA4AEA6gGJBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3N5T01PLWZZdXd3TnJib1d0YkxjaVllOEROeDhuTnRfX3p0OHlHdGhONVpMcUNaY3lpLUt3WlNlQW41S2V2V0ZpME90RlpUOVU2OVVENWVwYS1tQk4ySFB0Yk1jMDFFTkh1blVYZlJrY3RMX1dNbUNFR3pESEM2azNYdkhHTkd4VDVfWUdGN1VTbnhMYzN2R2JNbTlJOURpbnNOMEd1azhmLXlneGlMQURxRGMzTkdSdnJQS21uQjhoa3BjZ3VIeEo1LUwyRXRUWHZ0dEk0UDJCS2EwV2dmSkxtZ2pjSk4zQVlkdWtmaGtnQUdLLWEwTzhfbHh5cjIzM2dhTFJqQ29MN2VVdE9keG9sdmY2ZDRNOUNtZTlvZl9tRjdzQTdHS1VUdFRtT1dhU3BxV2dscGc5bE1uOEZrSThyejI1Z0xmYktLbHUwTHF4VEJWRE1nT3hwdnR4RlZLaFElMjUyNnNhaSlt8J9NZmwtWVNZN2JEOXFwVXNIWVFkTHZQSHIyY1Ftb29CNmltX1V3OFdsc1RlbjlQWkJ5Z1FsNVprQ2k1TXk2NEk1NkZUeFFqLTdBN0s3a1JsQTUxc3JwQnptRzJaRllhRDV6TU1TSzNxM0hWNTZxcEglMjUyNnNpZyUyNTNEQ2cwQXJLSlN6TFJXMmdfeHAyc3hFQUUlMjUyNmZic19hZWlkBaY4JTI1NUJnd19mYnNhZWlkAQ8BFBwyNnVybGZpeAUkKDElMjUyNmFkdXJsBRA08AEA2AIA4AKf8D_qAhZFl_CLOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqAwDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDjIxNy4xMTQuMjE4LjI0qAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCADgBADwBISyjRuIBQGYBQCgBQDABQDJBQBliRTwP9IFCQkFC3QAAADYBQHgBQDwBQD6BQQIABAAkAYAmAYAuAYAwQYBHwEBENoGFgoQAQkuAQABe0zgBgDyBgIIAIAHAYgHAKAHALoHDwFEABgJlSy9BkAAyAfi1wXSBw0VcAE4CNoHBgknaOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=3f86252e98d71a1d471cdd730c23a06340d953b6

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1660201230&bdh=xrqjvdgltlJ-bMMPjX48ful5icE.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=120x600&cb=836569151&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 454c55f3-9b3c-4743-98d5-1b624f813140
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame DD95 28 KB
28 KB 66ms
19ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 20:36:54 GMT
x-content-type-options: nosniff
age: 37417
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 10 Aug 2023 20:36:54 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 4E31 0
745 B 36ms
31ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2e7904ed-6ba2-451e-96fa-1d726bcf69a9
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E40E 0
745 B 54ms
24ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1477c8ff-6c64-4b00-842f-b5fe5df6f05e
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK ttj Show response
ib.adnxs.com/ Frame 32A1 4 KB
4 KB 53ms
37ms Script
application/javascript 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ttj?ttjb=1&bdc=1660201231&bdh=zotXCawRhwSTWRMNhTVIvkbP2B8.&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fb58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=9896220&psa=0&cb=225888887&gdpr=0&gdpr_consent=&loc=%2C&pubclick=https%3A%2F%2Ffra1-ib.adnxs.com%2Fclick%3FAAAAAAAAAAAAAAAAAAAAAAAAAIA9Crc_AAAAAAAAAAAAAAAAAAAAALaJ1cLJ-sNB8tkmU_jfwH0OqfRiAAAAAGMBHQHKIAAA5QAAAAIAAAAEWWMDmKoUAAAAAAAAAAAAVVNEAHgAWAJrrgAAAAABAgEAAAAAAMwA0xbE-gAAAAA.%2Fbcr%3DAAAAAAAAAAA%3D%2Fbn%3D93154%2Fclickenc%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: ib.adnxs.com
URL: https://ib.adnxs.com/ttj?id=9896220&psa=0&cb=225888887&gdpr=0&gdpr_consent=&loc=,&pubclick=https://fra1-ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAAAAAAIA9Crc_AAAAAAAAAAAAAAAAAAAAALaJ1cLJ-sNB8tkmU_jfwH0OqfRiAAAAAGMBHQHKIAAA5QAAAAIAAAAEWWMDmKoUAAAAAAAAAAAAVVNEAHgAWAJrrgAAAAABAgEAAAAAAMwA0xbE-gAAAAA./bcr=AAAAAAAAAAA=/bn=93154/clickenc=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssyOMO-fYuwwNrboWtbLciYe8DNx8nNt__zt8yGthN5ZLqCZcyi-KwZSeAn5KevWFi0OtFZT9U69UD5epa-mBN2HPtbMc01ENHunUXfRkctL_WMmCEGzDHC6k3XvHGNGxT5_YGF7USnxLc3vGbMm9I9DinsN0Guk8f-ygxiLADqDc3NGRvrPKmnB8hkpcguHxJ5-L2EtTXvttI4P2BKa0WgfJLmgjcJN3AYdukfhkgAGK-a0O8_lxyr233gaLRjCoL7eUtOdxolvf6d4M9Cme9of_mF7sA7GKUTtTmOWaSpqWglpg9lMn8FkI8rz25gLfbKKlu0LqxTBVDMgOxpvtxFVKhQ%2526sai%253DAMfl-YSY7bD9qpUsHYQdLvPHr2cQmooB6im_Uw8WlsTen9PZBygQl5ZkCi5My64I56FTxQj-7A7K7kRlA51srpBzmG2ZFYaD5zMMSK3q3HV56qpH%2526sig%253DCg0ArKJSzLRW2g_xp2sxEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

50a4579f2e6d40f40f7afd5015c1c1722e4bc1396b50744bc71457fe9aceb0d1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:31 GMT
Content-Encoding: gzip
X-Creative-ID: 321852778
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 7f908fe7-5144-4859-9674-cc76ef451b4f
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D247
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

49ms
48ms

Document
text/html

2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 11 Aug 2022 07:00:31 GMT
expires: Thu, 11 Aug 2022 07:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:31 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame E090 0
841 B 21ms
20ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKPC_BMjwUAAAMA1gAFAQiO0tKXBhCmyJyJ79Sk5VwY8rObmYX_t-B9KjYJjSYXY2Adpz8R6lxRSghWoT8ZAAAAgOtR2D8h6lxRSghWoT8pjSYJJMgxAAAA4FG4nj8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvBAmAHYBaABWqgBA7ABALgBAcABBcgBAtABANgBAOABAOoBkQVodHRwcyUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGUJDixuZXQlMkZwY3MlMkYFEhwlMjUzRnhhaQEI9KAEREFLQU9qc3UzbXlESkpRV3lWYXZWcEtYQ1UybmY2SmdQYnY4cUNMbGpaSjJhU2lRUFB0SEVlcm5DS3hmV0kxS2Zsa0IyQ1dRZERCRFM5WWZxMmtHaEM0LWpmNGtHSXJLdWV1RDBzZkdvbVhISUZYSzBjYTRPVDZGWnE3a1dQRkVTWGRRVkNwTnR3dl9kZVBWN3BycWw2M0RLdmxfWFlvUWtxdFFzRDYwU2plUnItZkE1U1NjVno3NkU0V0c1RGlhM1IyNTZscVBHdGpyMHI3dkk1OUpuSkR5V3JIRFlPem9qZVJTS3dRX2NTMXZuQnYzOXBnNW04YmJMdG1tbVVfU1djeVZsZjJrbVJnVnUtbHhneUZLZ0RWanlsZVN5YVNpc0RqUEpzNUozZWRvbVlDd2VSZVpzYUpQZ2s1dTcyX0JmZFB0UWtqeFhtNDE0bTFQU0pqZFBmUW44V0dEemZKRGREeHh6c1JKaCUyNTI2c2FpJTI1M0RBTWZsLVlUSlpPS29yNFROSEdqanpxNTY0LUxjc2FVTFQ4dS0xQ1pqQ20tak04OGxMQlBEZDljQmdjbGZSRklibFlJdV9UdGFueGNjY0pwYXlZN2FUUmF4aWJySHpyOVlCT2ZPRjBYTzRiaHYzVFE3JTI1MjZzaWclMjUzRENnMEFyS0pTekxXaDdJQzBiZFhkRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABANgCAOACn_A_6gIWaHR0cHM6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6gEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmF3YmlkX2I9QUtBbWYtQnFXbzUtWmRJUk1fb1padVdjTDVRblFFMGRTQlZpNHVPMkdObkM3TS1aNUVIcWIzb0VPTzczNnQ4MHZJWTFERnZubWRjRV8tREw1dXgxeUF0ckdzNlR2Q1dvSWcmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNjY4NjMxNzg0MjQ5MzAyMzI3MCIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDjIxNy4xMTQuMjE4LjI0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBYqf6YOSs4yWFsAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBYX4D_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzY0ODE3MDE0MDe6Bw8IABAAGAAgADAAOL0GQADIBwDSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB9LRAYoIAhAAlQgAAIA_mAgB&s=31744d9be76d0a2cb5882c700ac9b0ccd26912c6&type=nv&nvt=5&jm=1003&px=0&py=0&bw=728&bh=90&sid=3332975361086859272&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=728&ph=90&ww=728&wh=90&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 319ca998-a6a6-4fe7-8596-159bfcc1da26
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 4F52 100 KB
34 KB 98ms
98ms XHR
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

838d641e3698d0a6dec062ef2f7911162b8f308ddedd54681054a3ddbe2d61e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 11 Aug 2022 07:00:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34997
x-xss-protection: 0

GET
H/1.1 200
OK 25b231a2-63ce-4709-90f6-f570226d133d.jpg
crcdn01.adnxs-simple.com/creative/p/3854/2021/11/5/29608708/ Frame 32A1 18 KB
19 KB 27ms
25ms Image
image/jpeg 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://crcdn01.adnxs-simple.com/creative/p/3854/2021/11/5/29608708/25b231a2-63ce-4709-90f6-f570226d133d.jpg
Requested by: Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: nginx/1.19.0 /
Resource Hash: 92a2d031b8b1448c3cc37f7321eed6f4bfb06519e36a7033c020775229fdec70

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:31 GMT
Last-Modified: Fri, 05 Nov 2021 17:27:15 GMT
Server: nginx/1.19.0
x-amz-request-id: 2a2b3ec4-a817-47eb-860d-f9ba1a70a95f
X-Clv-Request-Id: 2a2b3ec4-a817-47eb-860d-f9ba1a70a95f
ETag: "43529d26cec704c526bf312471d46e11"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Cache-Control: max-age=3888000
X-Clv-S3-Version: 2.5
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18681
Expires: Sun, 25 Sep 2022 07:00:31 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 32A1 0
817 B 46ms
44ms Image
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKpEaCpCAAAAwDWAAUBCI_S0pcGEJ-b8o3MmZmidxjys5uZhf-34H0qNgkAAAECCPA_EQEHEAAA8D8ZEQkAIREJACkRCQAxEQmoMJyC3AQ4jh5Ajh5IAlDqqryZAVio-zlgAGjas2B4g9gFgAEBigEDVVNEkgUG8E-YAXigAdgEqAEBsAEAuAECwAEDyAEC0AEA2AEA4AEA6gGRB2h0dHBzJTNBJTJGJTJGZnJhMS1pYi5hZG54cy5jb20lMkZjbGljayUzRkFBQVYDABhJQTlDcmNfUh0AaExhSjFjTEotc05COHRrbVVfamZ3SDBPcWZSaQUwMEdNQkhRSEtJQUFBNVEBEgEKJEFFV1dNRG1Lb1UBEhEBNFZWTkVBSGdBV0FKcnJnBRYMQkFnRQUJIEFNd0EweGJFLQkYJC4lMkZiY3IlM0QJHgUBCCUzRAEXKG4lM0Q5MzE1NCUyCdsUZW5jJTNENggBPGFkY2xpY2suZy5kb3VibGUJDiBuZXQlMkZwY3MROxwlMjUzRnhhaQEI9CEDREFLQU9qc3N5T01PLWZZdXd3TnJib1d0YkxjaVllOEROeDhuTnRfX3p0OHlHdGhONVpMcUNaY3lpLUt3WlNlQW41S2V2V0ZpME90RlpUOVU2OVVENWVwYS1tQk4ySFB0Yk1jMDFFTkh1blVYZlJrY3RMX1dNbUNFR3pESEM2azNYdkhHTkd4VDVfWUdGN1VTbnhMYzN2R2JNbTlJOURpbnNOMEd1azhmLXlneGlMQURxRGMzTkdSdnJQS21uQjhoa3BjZ3VIeEo1LUwyRXRUWHZ0dEk0UDJCS2EwV2dmSkxtZ2pjSk4zQVlkdWtmaGtnQUdLLWEwTzhfbHh5cjIzM2dhTFJqQ29MN2VVdE9keG9sdmY2ZDRNOUNtZTlvZl9tRjdzQTdHS1VUdFRtT1dhU3BxV2dscGc5bE1uOEZrSThyejI1Z0xmYktLbHUwTHF4VEJWRE1nT3hwdnR4RlZLaFElMjUyNnNhaSUyNTNEQU1mbC1ZU1k3YkQ5cXBVc0hZUWRMdlBIcjJjUW1vb0I2aW1fVXc4V2xzVGVuOVBaQnlnUWw1WmtDaTVNeTY0STU2RlR4UWotN0E3SzdrUmxBNTFzcnBCem1HMlpGWWFENXpNTVNLM3EzSFY1NnFwSCUyNTI2c2lnJTI1M0RDZzBBcktKU3pMUlcyZ194cDJzeEVBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQCKAll1ZignYScsIDI5MTM5OTQsIDE2NjAyMDEyMzEpO3VmKCdpJywgNjQyNTkzOCwgMTY2MDIwMTIzMSk7dWYoJ3InLCAzMjE4NTI3NzgsIDE2NjAyMDEyMzEpO5ICgQQhTDFUOEh3aVN0YkFZRU9xcXZKa0JHQUFncVBzNU1BQTRBRUFFU0k0ZVVKeUMzQVJZQUdEeUEyZ0FjQUI0QUlBQkFJZ0JBSkFCQVpnQkFhQUJBYWdCQWJBQkFMa0JLWXVJZ3dBQUFFREJBU21MaUlNQUFQQV95UW2rGEFEd1A5a0JllIBBQUE4RF9nQWRLYWlBUDFBUUFBZ0QtWUFnQ2dBZ0cxQWcBIgRDOQkIAEQBHfBPSUFnRFFBZ0RZQWdEZ0FnRG9BZ0Q0QWdDQUF3R1lBd0c2QXdsR1VrRXhPalV6TVRIZ0E0RXZnQVNGM0o0SGlBUzY1SjRIa0FRQW1BUUJ3UVEBYQkBBE1rEaEgQUFBRFlCQUR4FaUoQUFBaUFXX0tha0YBDAEBEDhELXhChbMJAQR3UZGuDER3UDgZKAxBRURSLigAADIuKABoLUFGb0kwRzhBWDMwT1VILUFYSzdiRUJnZ1lEge84aUFZQWtBWUJtQVlBb1FZCWkBYCQ2Z0dCTElHSkFrDRQMQUFBQh2_BEJrARIJAQBDHRiwTGdHQ2cuLpoCmQEhZ1JFbTZ3aVN0YkFZRU9xcXZKa0JHS2o3T1NBRUtBQXhBCT9YQThEODZDVVpTUVRFNk5UTXhNVUNCTDARYQxEd1AxHWEARhEYDEFBQUcdGABHHRgASB0YEEhnQWlRERBARHdQdy4u2AIA4AK50DDqAhallSg6Ly93aGVyZWdvZcWT8HkvgAMAiAMBkAMAmAMZoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA4yMTcuMTE0LjIxOC4yNKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANIEDjM4NTQjRlJBMTo1MzEx2gQCCADgBADwBOVxIIgFAZgFAKAF_xEBGAHABQDJBQAFARTwP9IFCQkFC0AAAADYBQHgBQHwBYOVJ_oFBAFuKJAGAJgGALgGAMEGASHh-CDQBqEP2gYWChAJERkBXBAAGADgBgHyBgIIAIAHAYgHAKAHAboHDwFIBBgABbYsvQZAAMgHg9gF0gcNFXYBOAjaBwYJJ2jgBwDqBwIIAPAH0tEBiggCEACVCAAAgD-YCAE.&s=d3fb7dd9cc4fecba6893f701f274090816d6234c

Requested by

Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: f352e578-9a10-4b26-a375-2c8615c9e98c
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 4B9F 52 KB
17 KB 22ms
21ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com
URL: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 8345
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 11 Aug 2022 07:00:31 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 03 Aug 2022 04:41:10 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 218105, 133627
X-Served-By: cache-lga21969-LGA, cache-hhn4050-HHN
X-Timer: S1660201231.278690,VS0,VE0

GET
DATA 200
OK truncated
/ Frame 32A1 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6ce3d69a5f6c9873463771388ff71311b0bfa7682d2bfc62a06c9f5f89ff942b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 32A1 0
0 58ms
58ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssWn70Qk9e9Ra8cxRd86Vh5Qonet-ZqGNBcpDGdkEko2kD85cBeVcqaukKo_yN2c08q4ItjaRO70dAE5F9YOr2lHjdA1K-0SrRH4Ah8yLXK_Bdyd70bG9nMUoCYB-fM368DIWPFopLvZf1PVhv2enhmswQPaRMINFGcMmnh0iB3P4Y4fLjFXbvTD3nfLg6KABVcuLJgRx8HZXf5CplY-bdQWmYmwwzqbb1woPnEMNREK3xkT_o05aPnrWrQDqsnSYEgydEnK_anH3FE0mTm4sjijAMjKUscb4FrPvj67K0fXVJQJ_gWGpO_s4NOWVCIgx9JtW934XCYnyQKzxlXvirprBlNNwA0Q6c&sai=AMfl-YQxLYoZ9lJ6DB91QCKE1r9HmLGIEsL46bzHb9xXXi9ezFszze1SrMaDdQ2DMWlFOF69U710SQOTEH4fZm1cZxrzrwL1uKAEikQ5-X8C4l3W&sig=Cg0ArKJSzDUMRtd_qB4uEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:31 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 11 Aug 2022 07:00:31 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4F52 8 KB
893 B 69ms
28ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4cf6f3dffbc65f9231255bf31f40ddc84a45bc57428b41d6786afc7153b90b7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 11 Aug 2022 06:39:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 11 Aug 2022 07:00:31 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 11 Aug 2022 07:00:31 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame 4F52 2 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623cd019389b2c8dcd7a61982ff834b85f6082663474f08b784e07f0c3fb954d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:59:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1202
x-xss-protection: 0
server: cafe
etag: 10137335727447750368
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:59:02 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/ Frame 4F52 31 KB
12 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

73a8c4643090bc508a479abca9b19393744e21ab711641ee147c2495dfd3d8b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:55:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 323
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11917
x-xss-protection: 0
server: cafe
etag: 3600686600815956419
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:55:08 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame 4F52 3 KB
1 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabeba94738a961f0e3ee62c071f3d3759cb1bc06fad8a9f487bd28586203ba0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:59:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1431
x-xss-protection: 0
server: cafe
etag: 17826921741551292351
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:59:39 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4F52 140 KB
43 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a2f253ec609c302adb1b3c7ae3e02520fe888f9b71507e7b9d32fc65d59db12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44011
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1659958456967243"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 11 Aug 2022 07:00:31 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/ Frame 4F52 26 KB
10 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220809/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7872900e6e1637d3307f8d3d640907ee51aab404f0a2685a4c54254caac025d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 06:53:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 396
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10372
x-xss-protection: 0
server: cafe
etag: 3359820733324659293
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 Aug 2022 06:53:55 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4F52 0
0 27ms
26ms Image
text/html 2a00:1450:4001:80b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT9CiTq9bFJo8V5PgJWJ2N44BmM952Ctv8kzwmaYlG89xU8NbuIoH_OSIAIGwvoH2gdLTS7Rg3hb9q5TxRMkoYIONyejg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3 200 8ab3c530fd8e92b79021f3068786d509.js Show response
www.gstatic.com/mysidia/ Frame 4F52 42 KB
16 KB 60ms
21ms Script
text/javascript 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/8ab3c530fd8e92b79021f3068786d509.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

125e014d00c3569891c3689625973016278837e431c2f029728552316e38d4d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 22:31:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30554
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16306
x-xss-protection: 0
last-modified: Wed, 03 Aug 2022 21:59:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 08 Nov 2022 22:31:17 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4F52 0
17 B 65ms
65ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CgS7YDqn0Ysy0N-u4-wbgoYXgDpC--M5rr82B2dQPz7e-z4gKEAEg5pfWJWCVgoCAmAegAZ3MwP0CyAEBqAMByAPLBKoE2AFP0AxXy6KfmI1FC8fhsXaQFaprpQz3vV7OtHGVEI9T71nODLto-uuBAzT5qXem7H9TzMCkUUJYZU5CujJXjQJoDkpQKmG-25jJIlga5duwgd1B2q44DoQf2qffY_5M9lGRl6GH7sncpS5bgSuooUyPyv2r00GmX-FI79exM7qNQPXSri8zUeGQOis_9Loia4KnpJ_r861WZ9nTreVOUSQ4z4320Jy2Ft6pNfzqVaXAxQF4E17qFhCuCrfXlE6M2Jx94P4jSqlkH9mwgiJbPdRee04fpdM9n9rABJ_8xbf8A5IFBAgEGAGSBQQIBRgEgAfLs7-CAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB0ggRCIDhgBAQARgAMgKqAjoCgEDyCA5iaWRkZXItMzA1NjQ0N4AKBMgLAdgTDIgUAtAVAZgWAYAXAbIXCAoGCAASABgA&sigh=hh4UQUIuao4&uach_m=[UACH]&pr=10:0.045146&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 11 Aug 2022 07:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 4B9F 0
745 B 21ms
21ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e11202ad-cf97-43fb-ab72-2a606f690d7d
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 lIG_-rjQweUtsPTJkqViasoL1XPo6OtXzg5InKx-NMQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 61FE 36 KB
14 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lIG_-rjQweUtsPTJkqViasoL1XPo6OtXzg5InKx-NMQ.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224021534/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9481bffab8d0c1e52db0f4c992a5626aca0bd573e8e8eb57ce0e489cac7e34c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 07:43:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170223
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14125
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 07:43:28 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4DDC 143 B
163 B 19ms
18ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1279
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Thu, 11 Aug 2022 06:39:12 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4F52 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 21f4bab86d0e742cbc0adf86d32cb1f758a35f92728e05f8f2cb6cf453f676fe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v45/ Frame 4F52 28 KB
28 KB 63ms
21ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v45/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a6fab14bfe7b33fe5dc5349a2bb3720037e0ed7ebe621b352340f9514d83c08

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Wed, 10 Aug 2022 20:36:54 GMT
x-content-type-options: nosniff
age: 37417
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28288
x-xss-protection: 0
last-modified: Wed, 01 Jun 2022 19:05:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 10 Aug 2023 20:36:54 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4DDC
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

35ms
35ms

Document
text/html

2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 11 Aug 2022 07:00:31 GMT
expires: Thu, 11 Aug 2022 07:00:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:31 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 55ms
55ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022080801&jk=1102085089393110&bg=!GBulG1_NAAa4hXTbmIU7ACkAdvg8Wk620gi-FHmrLd2pvphrccJvsXWQPquTGIAKbgFdqd-rPWdpmgIAAABXUgAAAAFoAQeZAuHHqQneHwSGbTPcUzE2o0zpJyCY1VXyPGSVtFSb81mdlXq_Ta7kKS_JUvUli_8TRuUFTLZ3f6REWHjyoUvL1J-tMtuHXL9NLv_jANok06h8-WztfeVe5dFCys8OprpSW-mz7N8JqijOgh20GCj5HYheDSFS0JvfoaHjf3PwdTW_SLu7zxIWLF0KJsR3pTZySuBKrlUL8FOHdV7Q6numXXrToCCC0fj9UVa22NDF2P0fSHnt6M6YF4WIRe1oKKJ-zdDDrrZpzgZhY6lHjQ3fbtoGaPQ8r4sOhRkAz3v0WYkmWCFI7HXLd0Y1XqUhngRphhCd1S9e5n7dmnDDe4OnwneJV-bxGWWsqGn-2TZ4QZ3Pb1C1lU5uyLxR8x8r8o4UGqHfBOW_qxEbzbCHG0qg8_a4MFtn2jnaXQt8l2NTFrTxnUfVIjhn0IPkdJAF1SkDLKZC_f46wXp5j65iG-Xvp3UxYFIGnBWSx4LF3U2-_us9JCSu7_FGCBXK0t23-0ri8pvjd2X6U7gxDwQpny969FrvKQF4poywWPtfp_OT-BrPcXXEPJDLPwFp6Z4Ys1EeFuTW4KtIN25cVwBQrHC-6-6xGCxryEb3cBbIMojS709HLWS_PU9gkULzWnAwMknaOIGUPT4MQelsmH3A0epk29k4Op7QTpsGH1XdLMX_fDIZ1D4W9-i3Gw2D2emNimBALQWNmtBgNAPoYGeH9IM0OyUKbSMpKOetMiIhjqE0z6iQAURE-SiwxzoeswjRvOhslunSeKDSbTvvNx-mKrewgsBboUCFI4zqlx7P72txK1WLVpbFEuYJ6SNYbOiAKhASlEIlZpZYTOr41j1PM8swQ39uvLwX1kqn5YE-17cUdOVY8YJO2lVcgsLujGnFN6bNqvrgZpDOq_41vVij6dOohETv6om3H__4dwl8sd7wJoKl6IhYnksR2x-ysG1RZuiRsaRtoCG9Q3gByxMhulLE2lqAFQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H3 200 lIG_-rjQweUtsPTJkqViasoL1XPo6OtXzg5InKx-NMQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 469B 36 KB
14 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/lIG_-rjQweUtsPTJkqViasoL1XPo6OtXzg5InKx-NMQ.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20224021534/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9481bffab8d0c1e52db0f4c992a5626aca0bd573e8e8eb57ce0e489cac7e34c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Tue, 09 Aug 2022 07:43:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170223
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14125
x-xss-protection: 0
last-modified: Mon, 08 Aug 2022 16:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 09 Aug 2023 07:43:28 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 0F57 0
837 B 35ms
35ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F&e=wqT_3QKTBugTAwAAAwDWAAUBCI3S0pcGELiZs_CJx4ryfBgAKjYJW7BUF_Ayqz8RRIR_ETRmpD8ZAAAA4FG43j8hRA0SACkRJAAxCRuwnj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreM3ZBYABAYoBA1VTRJIBAQb0jwKYAdgFoAFaqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjQwMjE1MzQvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfYj1BS0FtZi1DWWVSV1lPdHctb1plTGM2RlpnZFBFWE0wQWhkcVlkZkZKT1B2a2pmek9DR2VJUnkxaWlodnI4TWdNWWwzRGYwZkZCOXVZaXEyV1dGSHg5dXpIMVhxUHRsVFJGQSZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhM4OTk5MzY0Mzc4MDUxMjY3NzY4Igg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQOMjE3LjExNC4yMTguMjSoBACyBA8IABABGNgFIFooADAAOAK4BADABADIBADaBAIIAeAEAfAEp6LLJYgFAZgFAKAFv_eehL7ztYwmwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwgAEAAYACAAMAA4vQZAAMgHzdkF0gcNCQAAAAAAAAAAEAAYANoHBggAEAAYAOAHAOoHAggA8AfS0QGKCAIQAJUIAACAP5gIAQ..&s=296789b338a3da87bc858ed2f7003b6e608dd893&type=pv&jm=1003&px=436&py=474&bw=728&bh=90&sf=1&sid=3918087281505633285&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:31 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1568bc18-78cc-4e2e-afaa-0bdce8b5aaee
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 14A5 42 B
64 B 103ms
55ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsusIj0VsOwKJQp_bU4JotrUB7OMveTHeW-jQmyyhI91EarhZfeqiZ6-TgrQGyVpIjsm3dC9mQSgpsar6-5MpAobgwCURJcGq3x8mNN-663wn8D1Go4-&sig=Cg0ArKJSzMxmdnTq4lyjEAE&id=lidar2&mcvt=1000&p=474,436,564,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220808&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1660201230631&rpt=260&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 50A3 42 B
64 B 55ms
54ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuCwJHblCN5JFk8WdU8Mfuy8t0yD4YPY8XgAD8lMA-T0r_IF-wg1Gk_KA_XqIZR2Vje7qhSl3PJ4XaRLj4zauwDer7UQ-x88-Dsn6o3FvpZwBCsCIBU&sig=Cg0ArKJSzCKaZLEUHXwdEAE&id=lidar2&mcvt=1000&p=1127,276,1217,1004&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220808&bin=7&avms=nio&bs=0,0&mc=0.81&if=1&vu=1&app=0&itpl=19&adk=3878002045&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1660201230653&rpt=445&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C6BC 42 B
64 B 54ms
54ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstF0kW0hCI56IB5eYI4jbeDvFUt4rtdKaqhsXVZ34ZmL-_9TZPcnAWJrMRUugDONzRaVAsnZV3m6moyAsYmxjH51FlbtOGl6pG5bz71B-mNCAJa9ehk&sig=Cg0ArKJSzMC5Ry33HLrgEAE&id=lidar2&mcvt=1000&p=666,1091,916,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220808&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1660201230643&rpt=505&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b58d9efbe08cd713e66b6e9655bd0ddc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 4E31 0
745 B 67ms
66ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:32 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: c66619c5-6565-41bf-971b-728996add747
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame E40E 0
745 B 37ms
36ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:32 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9b7c2bfc-fd49-4a89-aee5-c060da964055
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame E090 0
841 B 27ms
26ms Ping
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKPC_BMjwUAAAMA1gAFAQiO0tKXBhCmyJyJ79Sk5VwY8rObmYX_t-B9KjYJjSYXY2Adpz8R6lxRSghWoT8ZAAAAgOtR2D8h6lxRSghWoT8pjSYJJMgxAAAA4FG4nj8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvBAmAHYBaABWqgBA7ABALgBAcABBcgBAtABANgBAOABAOoBkQVodHRwcyUzQSUyRiUyRmFkY2xpY2suZy5kb3VibGUJDixuZXQlMkZwY3MlMkYFEhwlMjUzRnhhaQEI9KAEREFLQU9qc3UzbXlESkpRV3lWYXZWcEtYQ1UybmY2SmdQYnY4cUNMbGpaSjJhU2lRUFB0SEVlcm5DS3hmV0kxS2Zsa0IyQ1dRZERCRFM5WWZxMmtHaEM0LWpmNGtHSXJLdWV1RDBzZkdvbVhISUZYSzBjYTRPVDZGWnE3a1dQRkVTWGRRVkNwTnR3dl9kZVBWN3BycWw2M0RLdmxfWFlvUWtxdFFzRDYwU2plUnItZkE1U1NjVno3NkU0V0c1RGlhM1IyNTZscVBHdGpyMHI3dkk1OUpuSkR5V3JIRFlPem9qZVJTS3dRX2NTMXZuQnYzOXBnNW04YmJMdG1tbVVfU1djeVZsZjJrbVJnVnUtbHhneUZLZ0RWanlsZVN5YVNpc0RqUEpzNUozZWRvbVlDd2VSZVpzYUpQZ2s1dTcyX0JmZFB0UWtqeFhtNDE0bTFQU0pqZFBmUW44V0dEemZKRGREeHh6c1JKaCUyNTI2c2FpJTI1M0RBTWZsLVlUSlpPS29yNFROSEdqanpxNTY0LUxjc2FVTFQ4dS0xQ1pqQ20tak04OGxMQlBEZDljQmdjbGZSRklibFlJdV9UdGFueGNjY0pwYXlZN2FUUmF4aWJySHpyOVlCT2ZPRjBYTzRiaHYzVFE3JTI1MjZzaWclMjUzRENnMEFyS0pTekxXaDdJQzBiZFhkRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnNhZWlkJTI1NUQlMjUyNnVybGZpeCUyNTNEMSUyNTI2YWR1cmwlMjUzRPABANgCAOACn_A_6gIWaHR0cHM6Ly93aGVyZWdvZXMuY29tL4ADAIgDAZADAJgDGaADAaoD6gEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmF3YmlkX2I9QUtBbWYtQnFXbzUtWmRJUk1fb1padVdjTDVRblFFMGRTQlZpNHVPMkdObkM3TS1aNUVIcWIzb0VPTzczNnQ4MHZJWTFERnZubWRjRV8tREw1dXgxeUF0ckdzNlR2Q1dvSWcmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNjY4NjMxNzg0MjQ5MzAyMzI3MCIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDjIxNy4xMTQuMjE4LjI0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBYqf6YOSs4yWFsAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBYX4D_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzY0ODE3MDE0MDe6Bw8IABAAGAAgADAAOL0GQADIBwDSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB9LRAYoIAhAAlQgAAIA_mAgB&s=31744d9be76d0a2cb5882c700ac9b0ccd26912c6&type=pv&jm=1003&px=0&py=0&bw=728&bh=90&sf=0.81&sid=3332975361086859272&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:32 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e0346420-6d1e-4953-bfdd-991d4d0d50b5
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DD95 42 B
64 B 64ms
63ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstH-fUgWinf0p_O0eUglJYW1BvzbeRMO-qGInOtP3-ljAucBGlqAJaegUkLyDwlHbUGwV99qCnk8pDhm37ZI6u0v-nk6I7O4ZUv7e3jdBUZTbPLsduB6RRod04Ny55HAxJ2Ks1GAcAfcbZ5&sig=Cg0ArKJSzCEUnAsfyOI-EAE&cid=CAASF-Ros0w6bY6egi83DPTky41GUWS-jYm-&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220808&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1660201230753&rpt=559&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 4B9F 0
745 B 21ms
20ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a2-18-235-93.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:32 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5c72bd1c-388e-4946-ac8d-5f90e88fa0c8
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 114ms
56ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

aeb925bb204a686701ed5795fc9a381422a479fca1cacbe35de200ac65319988

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:32 GMT
content-encoding: gzip
last-modified: Tue, 02 Aug 2022 12:51:23 GMT
server: nginx
etag: W/"62e91dcb-15b76"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 12 Aug 2022 07:00:32 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame E75C 15 KB
6 KB 39ms
39ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2b00ce902e9ef9e7031d76c62a72c1cb0054185e6691e9a72757a31cead715a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:31 GMT
server: Kestrel
server-processing-duration-in-ticks: 686698
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 89ms
30ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

aeb925bb204a686701ed5795fc9a381422a479fca1cacbe35de200ac65319988

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:32 GMT
content-encoding: gzip
last-modified: Tue, 02 Aug 2022 12:51:23 GMT
server: nginx
etag: W/"62e91dcb-15b76"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 12 Aug 2022 07:00:32 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4F52 42 B
64 B 65ms
65ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssK6wfqONr7todQIZbKon1R6Klx4MBiKwnjAi_L9RNMHwKrF_E2yAj0xk4hNW3Ox27xMy_494H1FyMiTDbk3TqqQpqNpQ2p58CEWsodLDZYuPfuO2FxaUsFKFTRTMsGgnVFKafvzs3QALlh&sig=Cg0ArKJSzOcebLt372WPEAE&cid=CAASF-Ro0T1hjNKKrW4RAGXnNYDvigwRRkwl&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220808&bin=7&avms=nio&bs=0,0&mc=0.81&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1660201231132&rpt=393&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame E75C
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=IAMetHxlRzV6clJXYkIwU1BNVkpidXd1aTEzZEpLTDdLQ3Y5ZDJkRDhUaisrUzh6NnVSc2x5ZWFPNWYvdDZCcWFuNXhDS24xZmxFQmFKenZpL1U1b2IvVTZRa0dndzdTZTJWTk9FaXdQaWc5NzA4azdyN2RiNmJDanNUVG...

438 B
630 B

89ms
30ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=IAMetHxlRzV6clJXYkIwU1BNVkpidXd1aTEzZEpLTDdLQ3Y5ZDJkRDhUaisrUzh6NnVSc2x5ZWFPNWYvdDZCcWFuNXhDS24xZmxFQmFKenZpL1U1b2IvVTZRa0dndzdTZTJWTk9FaXdQaWc5NzA4azdyN2RiNmJDanNUVGJzQk1SMngrc3pmSXVFMmxQdFFWL2FISmVBZktob29VZDd0T3VvaDF0MjM4WDRRN2EwdG9PQnVuaHhjcjRGeUxRR0poY29TekE2WTVhWjFRNTJnTlBUMTgvaHFaN3p3c2JaWUhlaW91RkNaRHlpdHZLdkZ4UWkvajhxbTUwTTYrV1pBSFBsT1F3QlVXZXNVSkdtaTJDa0FjZUducUpldz09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

d4fdf95ccdc25ed536e4ff53efadfb3e7108201094a37066de435445640710b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:32 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 6953
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:32 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=IAMetHxlRzV6clJXYkIwU1BNVkpidXd1aTEzZEpLTDdLQ3Y5ZDJkRDhUaisrUzh6NnVSc2x5ZWFPNWYvdDZCcWFuNXhDS24xZmxFQmFKenZpL1U1b2IvVTZRa0dndzdTZTJWTk9FaXdQaWc5NzA4azdyN2RiNmJDanNUVGJzQk1SMngrc3pmSXVFMmxQdFFWL2FISmVBZktob29VZDd0T3VvaDF0MjM4WDRRN2EwdG9PQnVuaHhjcjRGeUxRR0poY29TekE2WTVhWjFRNTJnTlBUMTgvaHFaN3p3c2JaWUhlaW91RkNaRHlpdHZLdkZ4UWkvajhxbTUwTTYrV1pBSFBsT1F3QlVXZXNVSkdtaTJDa0FjZUducUpldz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1487
content-length: 541
expires: 0

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame 7B83 0
0 32ms
32ms Document
text/plain 216.52.2.48
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Thu, 11 Aug 2022 07:00:33 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap5ams1

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 1DE3 9 KB
4 KB 73ms
20ms Document
text/html 18.66.112.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-120.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 82e3811cdfceb32fce78d37685ff4189f3927def60304312c3519603939f0ba8

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 155312
cache-control: max-age=345600
content-encoding: br
content-type: text/html
date: Tue, 09 Aug 2022 11:52:02 GMT
etag: W/"dded7396fbe6d087909057448e1ad0c8"
last-modified: Tue, 26 Jul 2022 15:11:15 GMT
server: AmazonS3
vary: Accept-Encoding Origin
via: 1.1 fb49d852ca52c03c834ce98098b51516.cloudfront.net (CloudFront)
x-amz-cf-id: mLQm8Xk9A29yPbqfVca8O27OeFwxnQ5PtRe90goF3Xu3xb03g6V10w==
x-amz-cf-pop: FRA56-P5
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:37f5e49a-fa66-49da-8441-dd45098ed05e
x-amz-meta-codebuild-content-md5: b40e23c2c399349f8349f9ae9edec2ec
x-amz-meta-codebuild-content-sha256: 495aaab93a2848b45bf77774751801430fcd8a0741179b148bb54de4435f2b80
x-cache: Hit from cloudfront

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 00BC 23 KB
8 KB 102ms
35ms Document
text/html 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C359%2C97%2C55%2C99%2C3012%2C3011%2C3010%2C244%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C336%2C3014%2C337%2C338%2C339%2C70%2C77%2C38%2C182%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

39b52e8ba0ebff23cc4aa8a83e7b842ff656bd6e9e935c807008a9b27eedb775

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8335
content-type: text/html; charset=UTF-8
date: Thu, 11 Aug 2022 07:00:33 GMT
expires: Sat, 13 Aug 2022 07:00:33 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame 16B4 258 B
495 B 130ms
130ms Document
text/html 54.146.39.184
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1660201230304&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.146.39.184 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-146-39-184.compute-1.amazonaws.com
Software: / Express
Resource Hash: cb8223f111e367f49b7019c6cf9a53e2c6c9452173430bccb0d418716c51ac75

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
content-length: 258
content-type: text/html; charset=utf-8
date: Thu, 11 Aug 2022 07:00:33 GMT
etag: W/"102-CBNc/zjNheMos7etqW45cPnlvVs"
expires: -1
pragma: no-cache
vary: Origin
x-powered-by: Express

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame DC16 281 B
554 B 70ms
19ms Document
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 11 Aug 2022 07:00:33 GMT
ETag: "40014-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 204 /
onetag-sys.com/usync/ Frame 05EF 0
0 22ms
21ms Document
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1660201229955

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 5712 52 KB
17 KB 22ms
22ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1660201200000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 8347
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 11 Aug 2022 07:00:33 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 03 Aug 2022 04:41:10 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 218105, 133665
X-Served-By: cache-lga21969-LGA, cache-hhn4050-HHN
X-Timer: S1660201233.467819,VS0,VE0

GET
H2 204 /
onetag-sys.com/usync/ 0
38 B 30ms
30ms Image
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-store

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 5712 0
745 B 20ms
19ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:33 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7736df92-84e6-48c0-816b-71a0b0a08f2b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame DC16 31 KB
10 KB 20ms
19ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c3d3e53145b2e47ef3c4a2a08c8a644b8acf51380859a40d48a39447646e9a02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:33 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Jul 2022 20:44:25 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=31430
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9450
Expires: Thu, 11 Aug 2022 15:44:23 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame A72C 15 KB
6 KB 163ms
21ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=65526
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 11 Aug 2022 07:00:33 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 12 Aug 2022 01:12:39 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 5EAE 4 KB
2 KB 327ms
105ms Document
text/html 34.226.156.243
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.226.156.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-226-156-243.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 0fc43fbb7154bd2c734e47d5c0549168c9ff7392a913da1369aecd7f11cf9415

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 11 Aug 2022 07:00:33 GMT
etag: W/"04ee6a61642020e9d32957cebb8408219"
server: nginx
timing-allow-origin: *

GET
H2 204 /
onetag-sys.com/usync/ Frame 9B96 0
0 20ms
20ms Document
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 17BE 686 B
935 B 170ms
31ms Document
text/html 185.86.137.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 220214a476854452d680a21a85fabb5cf6c324270ef2dee7af6c32a446ede527

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 686
content-type: text/html
date: Thu, 11 Aug 2022 07:00:33 GMT

GET
H2

200

usermatch Show response
r.casalemedia.com/ Frame 5CD1
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
2 KB

115ms
54ms

Document
text/html

104.18.18.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.18.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e20bf6dfdf2efca9e38f0c2e63574c8c36787b19a29afd74b7a33464b4acac89

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 738f184f5d419b2e-FRA
content-encoding: br
content-type: text/html
date: Thu, 11 Aug 2022 07:00:33 GMT
dropped-udsids: 230|39|241|45|111|190|65|206
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y%2BLOI5gtTVcap5SuwPOEwWyuooqrqstfVKxYpf0O9BOGBfp7ChgWRDyAICBeZ%2F88z7c5JQOIw%2BWTj8Z8fJ%2FXHkFQaKOXX4KYqbnZCRHxClpPbrXBVIMYfA4wIBAVOoSITON3"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Is-Traffic-Usersync, Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 738f184eaea46958-FRA
content-type: text/html; charset=iso-8859-1
date: Thu, 11 Aug 2022 07:00:33 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
location: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zO%2BPJfRgJ6FVeAQyCFOclAsIbIltw%2FRptQH4ZGKIVHsPh0qnX8V6z%2FdOqnveUzb45%2F4PTAE%2BRv6aYksYxMetecuKfJmTIIJIkzsza%2FW%2Bz53iNu12rsgm5PnNSzcE%2F8GqLB1HLBpOajZIFw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 1DE3 0
239 B 308ms
22ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=9061488707909376498

0
344 B

104ms
104ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=9061488707909376498
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:33 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e5f8cdec-488a-46e2-aa28-27d70bb92e2e
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=9061488707909376498
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=FIHEuRZHhE5mR68ERtCsw972

0
350 B

103ms
103ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=FIHEuRZHhE5mR68ERtCsw972
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:33 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=FIHEuRZHhE5mR68ERtCsw972
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap6ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 1DE3 0
277 B 32ms
28ms Image
text/plain 216.52.2.48
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.48 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 11 Aug 2022 07:00:33 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap5ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://x.yieldlift.com/getuid?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D314%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiYjdjZjcyYTctM2QwYy00YzAxLWI2OTktMmZjOThlN2VlNDkzIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wOC0xMVQwNzowMDozMy45NDk1NjhaIn0=

0
432 B

115ms
109ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiYjdjZjcyYTctM2QwYy00YzAxLWI2OTktMmZjOThlN2VlNDkzIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wOC0xMVQwNzowMDozMy45NDk1NjhaIn0=
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:34 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiYjdjZjcyYTctM2QwYy00YzAxLWI2OTktMmZjOThlN2VlNDkzIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wOC0xMVQwNzowMDozMy45NDk1NjhaIn0=
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 1DE3
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1660201234058
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8359268245

70 B
264 B

40ms
40ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8359268245
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Server: Tengine
ETag: RX56bde7e24e7e45c0af4d63d802840e12005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=8359268245
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/html
Expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5131077722214552293

0
344 B

104ms
103ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5131077722214552293
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5131077722214552293
Date: Thu, 11 Aug 2022 07:00:33 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame 1DE3 0
498 B 487ms
142ms Image
text/plain 69.166.1.10
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.166.1.10 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:33 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: go-iad-2-7-18
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=466bcbb6-c8b9-4269-a20d-37a2b31e275e&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
356 B

142ms
142ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=466bcbb6-c8b9-4269-a20d-37a2b31e275e&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=466bcbb6-c8b9-4269-a20d-37a2b31e275e&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Thu, 11 Aug 2022 07:00:33 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-ovYGbdlE2uHQ0UtRygVgN5OmbUvoskXApE5M3s8-~A

0
366 B

116ms
109ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-ovYGbdlE2uHQ0UtRygVgN5OmbUvoskXApE5M3s8-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:34 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-ovYGbdlE2uHQ0UtRygVgN5OmbUvoskXApE5M3s8-~A
date: Thu, 11 Aug 2022 07:00:33 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D346%26uid%3DBUYERUID
https://ads.servenobid.com/sync?pid=346&uid=213a9a6b-5cb2-d6b6-982b-2b2635eff742

0
356 B

119ms
114ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=346&uid=213a9a6b-5cb2-d6b6-982b-2b2635eff742
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:34 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=346&uid=213a9a6b-5cb2-d6b6-982b-2b2635eff742
pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
cache-control: no-store
content-length: 0
vary: origin
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 1DE3
Redirect Chain

https://ups.analytics.yahoo.com/ups/58632/occ
https://ups.analytics.yahoo.com/ups/58632/occ?verify=true
https://ads.servenobid.com/sync?pid=339&uid=y-ovYGbdlE2uHQ0UtRygVgN5OmbUvoskXApE5M3s8-~A

0
366 B

115ms
110ms

Image
image/avif

54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=339&uid=y-ovYGbdlE2uHQ0UtRygVgN5OmbUvoskXApE5M3s8-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:34 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=339&uid=y-ovYGbdlE2uHQ0UtRygVgN5OmbUvoskXApE5M3s8-~A
date: Thu, 11 Aug 2022 07:00:33 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame DC16
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDZPT1kzTVAtQy1JUTgz

170 B
243 B

30ms
29ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDZPT1kzTVAtQy1JUTgz

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDZPT1kzTVAtQy1JUTgz
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame DC16
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=Li84onZURRq_j41RJIN7QA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=Li84onZURRq_j41RJIN7QA

43 B
556 B

119ms
117ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=Li84onZURRq_j41RJIN7QA

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: PVZKZVXKTAPXPQ4WN93V
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=Li84onZURRq_j41RJIN7QA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame DC16
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEO1oUJNIMvB-1dlfRhvn_es&google_cver=1

0
239 B

112ms
23ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEO1oUJNIMvB-1dlfRhvn_es&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEO1oUJNIMvB-1dlfRhvn_es&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
px.ads.linkedin.com/ Frame DC16
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L6OOY3MP-C-IQ83

0
730 B

283ms
239ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L6OOY3MP-C-IQ83
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: D444632B2BA54B8E8E5EBDF48AD620AD Ref B: FRAEDGE1315 Ref C: 2022-08-11T07:00:33Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-source-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXl8bjMwKo2UhEWXOi+UA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L6OOY3MP-C-IQ83
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 78e3bdce5107450057bade54d54a0a7e
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame DC16 70 B
265 B 126ms
39ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame DC16
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZGIzYmY3ODdlYTQ1ZmNiZWNlZmZhNTVmMDdiMTY1MjRjNjVlNjg0Mw

170 B
232 B

30ms
30ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZGIzYmY3ODdlYTQ1ZmNiZWNlZmZhNTVmMDdiMTY1MjRjNjVlNjg0Mw

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3216620.ip-141-95-98.eu

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=ZGIzYmY3ODdlYTQ1ZmNiZWNlZmZhNTVmMDdiMTY1MjRjNjVlNjg0Mw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame DC16
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/FHv-VW5GKaw5QWaOX8Bp5g?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6608250447240324841

0
239 B

53ms
53ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6608250447240324841
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

Redirect headers

date: Thu, 11 Aug 2022 07:00:33 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6608250447240324841
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

204
No Content

esync
token.rubiconproject.com/ Frame DC16
Redirect Chain

https://id.rlcdn.com/709414.gif
https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e

0
214 B

22ms
22ms

Image
text/plain

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Thu, 11 Aug 2022 07:00:33 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://token.rubiconproject.com/esync?pid=28028&puid=&pt=e
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame 16B4 2 KB
1 KB 75ms
26ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1660201230304&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 01:23:55 GMT
server: cloudflare
age: 3952
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 738f184ef8259ba7-FRA
content-length: 1168
expires: Thu, 11 Aug 2022 09:00:33 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 16B4 70 B
264 B 112ms
40ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=rjrqv8k&ttd_tpi=1
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1660201230304&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame A72C 0
42 B 392ms
110ms Script
text/plain 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=2603898&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:34 GMT
content-length: 0

GET sync
ads.servenobid.com/ Frame 17BE 0
0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 17BE
Redirect Chain

https://demand.trafficroots.com/sync.php?partner=3379&redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D137%26partneruserid%3D%7Btrafficroots_id%7D&gdpr=0&gdpr_...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=137&partneruserid=67750aada8&gdpr=0&gdpr_consent=

43 B
440 B

31ms
30ms

Image
image/gif

185.86.139.89
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=137&partneruserid=67750aada8&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.89 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

Date: Thu, 11 Aug 2022 07:00:34 GMT
Referrer-Policy: origin-when-cross-origin
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: text/html; charset=UTF-8
Location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=137&partneruserid=67750aada8&gdpr=0&gdpr_consent=
X-XSS-Protection: 1; mode=block
Transfer-Encoding: chunked
Connection: keep-alive
X-Content-Type-Options: nosniff

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 17BE
Redirect Chain

https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=
https://sync.tidaltv.com/genericusersync.ashx?dpid=3157&gdpr=0&gdpr_consent=&s_h=1
https://rtb-csync.smartadserver.com/redir/?partnerid=96&partneruserid=80acc70c-e3d5-4385-b249-1d6fc35177c2&gdpr=0&gdpr_consent=

43 B
425 B

135ms
31ms

Image
image/gif

185.86.139.89
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=96&partneruserid=80acc70c-e3d5-4385-b249-1d6fc35177c2&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.89 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?partnerid=96&partneruserid=80acc70c-e3d5-4385-b249-1d6fc35177c2&gdpr=0&gdpr_consent=
pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
x-xss-protection: 1; mode=block
expires: 0

GET
H3

200

1000.gif
id.rlcdn.com/ Frame 17BE
Redirect Chain

https://id.rlcdn.com/711890.gif?credir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D136%26partneruserid%3D&gdpr=0&gdpr_consent=
https://id.rlcdn.com/1000.gif?memo=CNK5KxoNCJHS0pcGEgUI6AcQAEJOaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2k9MSZwYXJ0bmVyaWQ9MTM2JnBhcnRuZXJ1c2VyaWQ9SgA

42 B
60 B

186ms
146ms

Image
image/gif

35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/1000.gif?memo=CNK5KxoNCJHS0pcGEgUI6AcQAEJOaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2k9MSZwYXJ0bmVyaWQ9MTM2JnBhcnRuZXJ1c2VyaWQ9SgA
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H3
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 11 Aug 2022 07:00:34 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 11 Aug 2022 07:00:33 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://id.rlcdn.com/1000.gif?memo=CNK5KxoNCJHS0pcGEgUI6AcQAEJOaHR0cHM6Ly9ydGItY3N5bmMuc21hcnRhZHNlcnZlci5jb20vcmVkaXIvP2lzc2k9MSZwYXJ0bmVyaWQ9MTM2JnBhcnRuZXJ1c2VyaWQ9SgA
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200 9.gif
id5-sync.com/i/102/ Frame 17BE 43 B
1 KB 75ms
29ms Image
image/gif 141.95.98.70
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://id5-sync.com/i/102/9.gif?gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.70 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/gif;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame 16B4 31 KB
24 KB 25ms
25ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1660201233770&ver1=2.2.3&qid=83233313f553333313f513430313&rnd=fe6kyyv7yw9a&cid=1041
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 01:23:55 GMT
server: cloudflare
age: 5319
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 738f184f28589ba7-FRA
content-length: 24217
expires: Thu, 11 Aug 2022 09:00:33 GMT

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame 16B4 26 B
304 B 76ms
23ms Image
image/gif 2606:4700::6810:76c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1660201233841&rnd=fe6kyyv7yw9a&ifm=1&uai=1&cid=1041&s=wheregoes.com&p=undefined&x=&adtg=&ats=0&atf=&nsi=&si=&nci=&nai=&pft=0&iip=0&adb=1&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1660201230304&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:76c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 01:23:47 GMT
server: cloudflare
age: 2306
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 738f184ff9ecbb9e-FRA
content-length: 26
expires: Thu, 11 Aug 2022 09:00:33 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame 16B4 26 B
88 B 78ms
25ms Image
image/gif 2606:4700::6810:76c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1660201233830661&ver=1.2r81&qid=83233313f553333313f513430313&p=undefined&s=wheregoes.com&x=&cid=1041&od1=&od2=&adtg=&nci=&nai=&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=fe6kyyv7yw9a&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&1=70daa0f09e60db325fdaccdd1a46fced&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1041&ifm=1&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=26&icp=https%253A//wheregoes.com/&irfl=26&irf=https%253A//wheregoes.com/&cty=4&fcs=0&flky=ver-fl-6-qid-fl-28-p-fl-9-s-fl-13-x-fl-0-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-0-nci-fl-0-nai-fl-0-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-&spfp=0&spfnp=0&sp1=Chromefl_andWindows&sp2=Chromefl_andWindows&adv=0&det=1&adb=1&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=0x0&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_10_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=19
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1660201230304&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20224021534%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:76c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
cf-cache-status: HIT
last-modified: Thu, 11 Aug 2022 01:23:47 GMT
server: cloudflare
age: 5201
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 738f184ff9edbb9e-FRA
content-length: 26
expires: Thu, 11 Aug 2022 09:00:33 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 5CD1 170 B
188 B 102ms
63ms Image
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YvSpETJG5fqxMRFagtdblgAABKUAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-54-175-87-114.compute-1.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 5CD1 70 B
264 B 41ms
40ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:33 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 5CD1
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvSpETJG5fqxMRFagtdblgAABKUAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvSpETJG5fqxMRFagtdblgAABKUAAAIB&dcc=t

43 B
645 B

116ms
116ms

Image
image/gif

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvSpETJG5fqxMRFagtdblgAABKUAAAIB&dcc=t

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: KT1JD2PKQ94MYVEMEACF
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 1W40H7CYXCFAJMPEYBC6
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YvSpETJG5fqxMRFagtdblgAABKUAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame 5CD1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YvSpETJG5fqxMRFagtdblgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEgV36HPW92hkj0jeCH8SZk&google_cver=1&gdpr=1

43 B
942 B

63ms
39ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEgV36HPW92hkj0jeCH8SZk&google_cver=1&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 738f18517b075ba4-FRA
pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ji2h45HRRnFW5Nf119ljXnXZSba5CNMXbFhn1h1M64uRxxU6fLYG1qiYQh1Hcz%2Bc0z6HZYqEaPRmZ49tRJLrimvceqQJV%2FUgeDBvsZQyIth6SEko4HtwORlcxRMt2Aho5X83KMbnklvedQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEEgV36HPW92hkj0jeCH8SZk&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 403 match
c1.adform.net/serving/cookie/ Frame 5CD1 0
331 B 217ms
32ms Image
text/plain 37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match?party=29&gdpr=1

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1 400
Request failed due to privacy signals getuid
ib.adnxs.com/ Frame 5CD1 0
0 26ms
19ms Image
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 691.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

GET
H2

200

rum
dsum.casalemedia.com/ Frame 5CD1
Redirect Chain

https://casale-match.dotomi.com/match/bounce/current?networkId=19998&version=1&gdpr=1
https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1660287634&gdpr=1

43 B
943 B

98ms
38ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1660287634&gdpr=1
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

cf-ray: 738f1851dcf291de-FRA
pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WD2Q9qAFmDJoQqdrPcuRbxmFqxWJa385Qhy%2FgjLKxvffVVQ0AEsFHDpq8BK4cUfzHJ%2B07l7%2F0h9JNwidCk03kLsfvF6cTeS4gvxNkP2mp3mXOixtiRh4tHIFLMbjzh6ilgw99OyH"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum.casalemedia.com/rum?cm_dsp_id=65&external_user_id=&expiration=1660287634&gdpr=1
pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
content-length: 0
expires: 0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/55940/ Frame 5CD1 0
15 B 141ms
134ms Image
text/plain 54.175.87.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55940/sync?_origin=1&redir2=true&uid=YvSpETJG5fqxMRFagtdblgAABKUAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

54.175.87.114 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.0.46 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
server: ATS/9.1.0.46
age: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 sync
ads.servenobid.com/ Frame 5CD1 0
357 B 138ms
131ms Image
image/avif 54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YvSpETJG5fqxMRFagtdblgAABKUAAAIB
Requested by: Host: r.casalemedia.com
URL: https://r.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://r.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=9061488707909376498

35 B
250 B

627ms
109ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=9061488707909376498
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:33 GMT
X-Proxy-Origin: 217.114.218.24; 217.114.218.24; 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 82c2549b-0fdb-48e8-83e5-f2922a33bb99
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://usersync.gumgum.com/usersync?b=apn&i=9061488707909376498
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=u_3d85be04-3f33-4581-8154-9bca7c4bc122&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=u_3d85be04-3f33-4581-8154-9bca7c4bc122&gdpr=0&gdpr_consent=&us_privacy=1---
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://x.bidswitch.net/sync?dsp_id=59&user_id=82732b66-0a69-4cef-98f0-70a5fbda1080&ssp=gumgum2
https://usersync.gumgum.com/usersync?b=bsw&i=37c3148d-0e0a-4348-a9a8-b2d5f041e8ff

35 B
250 B

126ms
125ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=37c3148d-0e0a-4348-a9a8-b2d5f041e8ff
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=37c3148d-0e0a-4348-a9a8-b2d5f041e8ff
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 5EAE
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28xbdvMhpIUS5qa1j4bkJwH_Rg6gkC50yFbue5n-GCByP9bdg89JLTKBVUSPOg315n%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=u_3d85be04-3f33-4581-8154-9bca7c4bc122&obuid=ENC(xbdvMhpIUS5qa1j4bkJwH_Rg6gkC50yFbue5n-GCByP9bdg89JLTKBVUSPOg315n)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://cs.emxdgt.com/um?gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redirect=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Demx%26uid%3D%24UID%26obUid%3DxbdvMhpIUS5qa1j4bkJwH_Rg6gkC50yFbue...
https://sync.outbrain.com/cookie-sync?p=emx&uid=9061488707909376498brt56811660201234334068ad&obUid=xbdvMhpIUS5qa1j4bkJwH_Rg6gkC50yFbue5n-GCByP9bdg89JLTKBVUSPOg315n

0
145 B

104ms
104ms

Image
text/plain

64.202.112.255
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=emx&uid=9061488707909376498brt56811660201234334068ad&obUid=xbdvMhpIUS5qa1j4bkJwH_Rg6gkC50yFbue5n-GCByP9bdg89JLTKBVUSPOg315n
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 64.202.112.255 Leesburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:35 GMT
Cache-Control: no-cache
X-TraceId: e112a784f04794b5bbe99afc5fc3245d
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=emx&uid=9061488707909376498brt56811660201234334068ad&obUid=xbdvMhpIUS5qa1j4bkJwH_Rg6gkC50yFbue5n-GCByP9bdg89JLTKBVUSPOg315n
date: Thu, 11 Aug 2022 07:00:34 GMT
content-length: 0
content-type: text/html

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=52d25fb9-f633-4587-b746-c723bce92e9e

35 B
250 B

430ms
109ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=52d25fb9-f633-4587-b746-c723bce92e9e
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 11 Aug 2022 07:00:34 GMT
content-encoding: gzip
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usersync.gumgum.com/usersync?b=opx&i=52d25fb9-f633-4587-b746-c723bce92e9e
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-fabca0cc-6224-4fcf-4d28-41555156ee5e$ip$217.114.218.24

35 B
250 B

294ms
107ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-fabca0cc-6224-4fcf-4d28-41555156ee5e$ip$217.114.218.24
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-fabca0cc-6224-4fcf-4d28-41555156ee5e$ip$217.114.218.24
Date: Thu, 11 Aug 2022 07:00:34 GMT
Connection: keep-alive
Content-Length: 128
Content-Type: text/html; charset=utf-8

GET
H2 200 gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 5EAE 43 B
322 B 94ms
87ms Image
image/gif 2a05:d018:d29:3602:7ccc:efc7:12f7:54b2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:7ccc:efc7:12f7:54b2 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=e2d6930f-9790-49d9-bc72-71ad7a8ab289

35 B
250 B

270ms
108ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=e2d6930f-9790-49d9-bc72-71ad7a8ab289
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=e2d6930f-9790-49d9-bc72-71ad7a8ab289
Date: Thu, 11 Aug 2022 07:00:34 GMT
X-CI-RTID: 0ccd2cfc-c208-4fd5-b57f-7f9efc7b0dbc
Connection: keep-alive
Content-Length: 108
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=GDPR

35 B
250 B

311ms
106ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=GDPR
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Thu, 11 Aug 2022 07:00:34 GMT
via: 1.1 varnish
server: nginx
age: 0
location: https://usersync.gumgum.com/usersync?b=snc&i=GDPR
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 348555263
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame 5EAE 0
44 B 349ms
104ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
content-length: 0
server: a

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=u_3d85be04-3f33-4581-8154-9bca7c4bc122&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=-Av-Y7EEl_Ip9O_gtn-U&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2LKBOYWVSN2FIVWF6SLQHFHV6Z3UNYWVK...
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=-Av-Y7EEl_Ip9O_gtn-U&us_privacy=1---

35 B
250 B

108ms
107ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=-Av-Y7EEl_Ip9O_gtn-U&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
P3p: CP="We do not support P3P header."
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=-Av-Y7EEl_Ip9O_gtn-U&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=bee2c6b9-1d82-423c-b087-17e01bc2a7dc

35 B
250 B

427ms
108ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=bee2c6b9-1d82-423c-b087-17e01bc2a7dc
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=bee2c6b9-1d82-423c-b087-17e01bc2a7dc
date: Thu, 11 Aug 2022 07:00:34 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 5EAE
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1752339990

70 B
264 B

40ms
40ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1752339990
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 11 Aug 2022 07:00:34 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Server: Tengine
ETag: RX56bde7e24e7e45c0af4d63d802840e12005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=1752339990
Cache-Control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/html
Expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=M4qhVFA8rbZV&ev=1&pid=558355

35 B
250 B

108ms
107ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=M4qhVFA8rbZV&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://usersync.gumgum.com/usersync?b=pln&i=M4qhVFA8rbZV&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-674f655b67-vqj8s
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 5EAE
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=701584948262487047

35 B
250 B

107ms
107ms

Image
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=701584948262487047
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 11 Aug 2022 07:00:34 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=701584948262487047
date: Thu, 11 Aug 2022 07:00:33 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 5EAE 0
358 B 136ms
131ms Image
image/avif 54.147.116.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=u_3d85be04-3f33-4581-8154-9bca7c4bc122
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.147.116.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-147-116-125.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

date: Thu, 11 Aug 2022 07:00:33 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 64FF
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=e68f62f4-a911-4c00-a481-9c673da5ccd5&gdpr=0&gdpr_consent=

35 B
250 B

281ms
108ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=e68f62f4-a911-4c00-a481-9c673da5ccd5&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 11 Aug 2022 07:00:34 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Thu, 11 Aug 2022 07:00:34 GMT
Expires: Thu, 11 Aug 2022 07:00:33 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4475 c1dc35a master zrh-pixel-x29 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=e68f62f4-a911-4c00-a481-9c673da5ccd5&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame ECA4
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YvSpEgAFlPW7cQBC
https://usersync.gumgum.com/usersync?b=atm&i=YvSpEgAFlPW7cQBC&gdpr=0&gdpr_consent=&_test=YvSpEgAFlPW7cQBC

35 B
250 B

378ms
109ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=YvSpEgAFlPW7cQBC&gdpr=0&gdpr_consent=&_test=YvSpEgAFlPW7cQBC
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 11 Aug 2022 07:00:34 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Thu, 11 Aug 2022 07:00:34 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=YvSpEgAFlPW7cQBC&gdpr=0&gdpr_consent=&_test=YvSpEgAFlPW7cQBC
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-hhn4055-HHN
x-timer: S1660201234.131817,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 6857 170 B
188 B 93ms
64ms Document
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=dV8zZDg1YmUwNC0zZjMzLTQ1ODEtODE1NC05YmNhN2M0YmMxMjI=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Thu, 11 Aug 2022 07:00:33 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame D686 15 KB
6 KB 20ms
19ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=65526
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Thu, 11 Aug 2022 07:00:33 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Fri, 12 Aug 2022 01:12:39 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame F4CB 70 B
264 B 68ms
67ms Document
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Thu, 11 Aug 2022 07:00:33 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 4F38
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY2...
https://cs.emxdgt.com/umcheck?apnxid=9061488707909376498&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID&b64_redirect=aHR0cHM6Ly91c2Vyc3luYy5ndW1ndW0uY29tL3VzZXJzeW5jP2I9ZW14Jmk9JEVNW...
https://usersync.gumgum.com/usersync?b=emx&i=9061488707909376498brt56811660201234334068ad

35 B
250 B

108ms
107ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=emx&i=9061488707909376498brt56811660201234334068ad
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 11 Aug 2022 07:00:34 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 0
content-type: text/html
date: Thu, 11 Aug 2022 07:00:33 GMT
location: https://usersync.gumgum.com/usersync?b=emx&i=9061488707909376498brt56811660201234334068ad

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 8967
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://usersync.gumgum.com/usersync?b=sus&i=YvSpEsCo8YkAAOPSekoAAAAA

35 B
250 B

110ms
109ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=sus&i=YvSpEsCo8YkAAOPSekoAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 11 Aug 2022 07:00:34 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Thu, 11 Aug 2022 07:00:34 GMT
Location: https://usersync.gumgum.com/usersync?b=sus&i=YvSpEsCo8YkAAOPSekoAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 1
X-SO-Cluster-ID: 62
X-SO-HostName: a-ad40152.dc2p.scaleout.jp
X-SO-IP: 217.114.218.24
X-SO-Key: YvSpEsCo8YkAAOPSekoAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":62,"gdpr":true,"ipv4":"0.0.0.0","key":"YvSpEsCo8YkAAOPSekoAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40152"}
X-SO-LB-Hostname: m-tgng37.dc4p.scaleout.jp
X-SO-Upstream-ID: a-ad40152

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 50A0
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://usersync.gumgum.com/usersync?b=rth&i=yOxtPHGgXfbNWd9EKN69&pi=gumgum&tc=1

35 B
250 B

360ms
108ms

Document
image/gif

3.214.33.241
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=rth&i=yOxtPHGgXfbNWd9EKN69&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.33.241 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-33-241.compute-1.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Thu, 11 Aug 2022 07:00:34 GMT
Expires: 0
Pragma: no-cache

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Thu, 11 Aug 2022 07:00:34 GMT Thu, 11 Aug 2022 07:00:34 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://usersync.gumgum.com/usersync?b=rth&i=yOxtPHGgXfbNWd9EKN69&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 7AB7
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

34ms
30ms

Document
text/html

23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 11 Aug 2022 07:00:34 GMT
ETag: "40014-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 11 Aug 2022 07:00:34 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 7AB7 31 KB
10 KB 26ms
26ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c3d3e53145b2e47ef3c4a2a08c8a644b8acf51380859a40d48a39447646e9a02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Date: Thu, 11 Aug 2022 07:00:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 12 Jul 2022 20:44:25 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=31429
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9450
Expires: Thu, 11 Aug 2022 15:44:23 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 7AB7 0
239 B 23ms
23ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L6OOY3MP-C-IQ83
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 5712 0
745 B 30ms
29ms Script
text/html 37.252.172.37
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.37 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS