wheregoes.com Open in urlscan Pro
138.197.62.132 Public Scan

Software

sffe /

Resource Hash

638d2f5ba5cf501a58131a42efe30aa2c2154904b0654a517cce4baeef308022

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 21:22:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 26722
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125956
x-xss-protection: 0
last-modified: Wed, 13 Apr 2022 08:34:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 19 Apr 2023 21:22:43 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 94 B
719 B 36ms
15ms XHR
application/json 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wheregoes.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bidder.am5.vip.prod.criteo.com

Software

cafe /

Resource Hash

d3eb7350a0588ff4e1af60592b47c3a3c535379bf789126fcdf9737d2e80057e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0
expires: Wed, 20 Apr 2022 04:48:05 GMT

GET
H2 200 CEAIT5QE.json Show response
srv.buysellads.com/ads/ 934 B
672 B 67ms
19ms Fetch
application/json 178.128.255.177
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.buysellads.com/ads/CEAIT5QE.json?forcebanner=446877&ignoretargeting=yes
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.128.255.177 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-nl-10.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: 388e8618cfc8733749c6367fa582bffc49ce34716cb40df46ebc5213715bf73f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 20 Apr 2022 04:48:05 GMT
content-encoding: gzip
server: //srv.buysellads.com
content-length: 559
vary: Accept-Encoding
content-type: application/json; charset=utf-8

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 155ms
77ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=f964fb6d-ea5b-4a9a-8157-bbd44b9cf102&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7207126439758618
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: f33e7f4a127efeebef3486164afd9781295b91904b98f7af8d26857d32463408

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:05 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
1 KB 239ms
160ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=b2d1abb6-b4a7-4905-b2c3-0f9d14b62248&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.871721964268038
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 63650442e839af9bd689bb29c6d38a204d483c252cd232a461f67177393d9cad

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:05 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 148ms
69ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=2%2C16&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=12168244-ac12-42f0-a319-a24a3582d0f9&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.8337473510072229
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 6feaa47b1b05e158748f2f7263e26266f0350eb294a3eaa5ff5145f31321e97d

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:05 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 265 B
1 KB 177ms
98ms XHR
application/json 2602:803:c003:200::21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=dd5d2ec3-df3f-4028-b46b-10b405809aee&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9398562883783521
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::21 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 12b4eedd53c6bb7b12ec0dbcf877f6c8c77ddac4f64ce5d10210b79e3eaeedb4

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:05 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 265
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
929 B 69ms
47ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7fabf89276625d1c6db51e96e3936178a83bd4b70602b9b6155579d048107865

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:05 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
290 B 110ms
62ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280a57d4001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: d014b9982786fbd71375df29963b94131435a198b0d8f09ba84a01e7d5463bef

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 119ms
72ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 4503c5c80993b09167c1587afc57328c7126ff3f65a96b16039de30121a15f23

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 129ms
82ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: ba0fab3fd6bcfac3e0e1c7fdea9022fd1b8c4f419c534364bb5c847a8bc70cb6

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 125ms
78ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 78ce222f68abfedfc6f25add2eb6af0db342e3a0fd89531fd2e325587fe57191

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 115ms
68ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 78b640c3937f222fa9af39aedb0a373937149b0fdcdfe1b30820ea474689cd92

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 3 KB
3 KB 146ms
100ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280be73c001e&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 929ce0881380e5bc8e1930de8bd39498981a229a6e7b4a4a482d8780ddcdc4de

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 2976

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 130ms
83ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 08e56962d652f8475dc3f49bbc8128a6a4c6a1bfd6e2dee1c9abf51ec01bf10e

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 117ms
71ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280c36f30017&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 87eea7cc42122ccea2c8f35e2a7c94f6db8458626254255ea9768224d3510cf2

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 117ms
72ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280cdbc80018&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 743735791d3ca3534dc21c1aff4591810ffb2cec71dd28afdd8299ccceb06314

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 66ms
33ms XHR
application/json 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=79238652399

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:05 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 adreq Show response
ads.servenobid.com/ 523 B
597 B 350ms
281ms XHR
application/json 52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=1182
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: cffd06e6ba95def0df3923ab4af9f28a0c3d2370fdc9e79c13374f668780a3b9

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 prebid-request Show response
onetag-sys.com/ 5 KB
3 KB 97ms
75ms XHR
application/json 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

Resource Hash

e206539b459169a9891d6f98be9a94707fceefb9e90afe645bc6244d36214224

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://wheregoes.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 3003

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 93 B
742 B 122ms
86ms XHR
application/json 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.43.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: 9927b6edb223a7f6270eb1f1622f07ce4479f0d37f46abbefc5cc5d3b76e7695

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 04:48:05 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 97

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 714 B
1 KB 436ms
395ms XHR
application/json 185.255.84.151
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&PublisherDomain=https%3A%2F%2Fwheregoes.com

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.151 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

9217052caad8c75a8bc8683be0f6966c37955a04da76e12f85cf4146e5eadd0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:05 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 380
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 714
expires: 0

GET
H2 400 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
331 B 386ms
185ms XHR
text/html 3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1650430085700&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&measurable=true&bids[0][bidId]=63e0d4b36143ece&bids[0][config][property]=WhereGoes&bids[0][config][zone]=Wheregoes_S2S_Leaderboard_ATF_ROS&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[1][bidId]=645838570b2ad8e&bids[1][config][property]=WhereGoes&bids[1][config][zone]=Wheregoes_S2S_Sidebar_ROS_Pos1&bids[1][sizes][0][width]=300&bids[1][sizes][0][height]=250&bids[2][bidId]=658955aa637224d&bids[2][config][property]=WhereGoes&bids[2][config][zone]=Wheregoes_S2S_Leaderboard_InContent_BTF_ROS&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&bids[2][sizes][1][width]=300&bids[2][sizes][1][height]=250&bids[2][sizes][2][width]=336&bids[2][sizes][2][height]=280&bids[3][bidId]=661f33a19cbc68c&bids[3][config][property]=WhereGoes&bids[3][config][zone]=Wheregoes_S2S_Sticky_Sidebar_ROS_Pos2&bids[3][sizes][0][width]=300&bids[3][sizes][0][height]=250&bids[3][sizes][1][width]=120&bids[3][sizes][1][height]=600&bids[3][sizes][2][width]=160&bids[3][sizes][2][height]=600&bids[3][sizes][3][width]=300&bids[3][sizes][3][height]=600&property=WhereGoes&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5352720a5ffb778e42dbb1d4b81c975c02018dd660e1fe9c430cbf13dba78762

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
x-powered-by: Express
etag: W/"38-oN4RNSEETikJBvZER0pAAAEOHrw"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 41 KB
16 KB 187ms
149ms XHR
application/json 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

c252ee88893286591c3bb5df06dfe485820312145aa28f3104f676d4bd6cae08

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 04:48:05 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: d578f9a3-969f-47a3-8b32-8c81e6bd0892
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 38ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 39ms
16ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 95 KB
14 KB 93ms
79ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4302344040976430&correlator=764641803730325&eid=31063378%2C31067029%2C31065401&output=ldjh&gdfp_req=1&vrg=2022041301&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Leaderboard_InContent_BTF_ROS%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%2C300x250%2C320x50%7C728x90%7C300x250%7C336x280%2C300x250%7C120x600%7C160x600%7C300x600&fluid=0%2C0%2Cheight%2C0&ifi=1&adks=1696759606%2C2861055222%2C3878002045%2C3809685794&sfv=1-0-38&ecs=20220420&fsapi=false&prev_scp=optimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26hb_size_appnexus%3D728x90%26hb_pb_appnexus%3D0.04%26hb_adid_appnexus%3D758294b06473f2d%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D728x90%26hb_pb%3D0.04%26hb_creative%3D78827815%26hb_adid%3D758294b06473f2d%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.04%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.02%26hb_adid_appnexus%3D76f15865a5e43f3%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D300x250%26hb_pb%3D0.02%26hb_creative%3D77221793%26hb_adid%3D76f15865a5e43f3%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.02%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318314037-7_123456%26optimize_inview%3Dfalse%26hb_size_onetag%3D728x90%26hb_pb_onetag%3D0.01%26hb_adid_onetag%3D731193cadd1dbcc%26hb_bidder_onetag%3Donetag%26hb_size%3D728x90%26hb_pb%3D0.01%26hb_creative%3D18731_70_38689783%26hb_adid%3D731193cadd1dbcc%26hb_bidder%3Donetag%26_bd%3Dbid%26_pl%3D0.01%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26hb_size_onemobile%3D300x600%26hb_pb_onemobile%3D0.14%26hb_adid_onemobile%3D74a13edba869fd3%26hb_bidder_onemobile%3Donemobile%26hb_size%3D300x600%26hb_pb%3D0.14%26hb_creative%3D48267046%26hb_adid%3D74a13edba869fd3%26hb_bidder%3Donemobile%26_bd%3Dbid%26_pl%3D0.14&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&sc=1&cookie_enabled=1&abxe=1&dt=1650430086159&lmt=1650430086&dlt=1650430083970&idt=1292&biw=1600&bih=1200&adxs=436%2C1091%2C276%2C1091&adys=474%2C666%2C1127%2C950&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1182x1412%7C300x952%7C862x1020%7C300x952&msz=1182x90%7C300x250%7C862x250%7C300x600&fws=516%2C0%2C0%2C0&ohw=1182%2C0%2C0%2C0&ga_vid=1647478675.1650430086&ga_sid=1650430086&ga_hid=466975713&ga_fc=false&btvi=0%7C0%7C0%7C0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a313516781b3a1a978e302e32d30bd1f67c15519bd651fdb8154f8baf935ccd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14058
x-xss-protection: 0
google-lineitem-id: 5936457980,5650535185,5651215826,5650535200
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138383350381,138343932699,138344350498,138343932690
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 42ms
20ms XHR
application/json 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022041301&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

543eb93f364213d8991c1a3441cc3f077b73f19a08c1873a4da456b8484691f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10599
x-xss-protection: 0

GET
H2 200 container.html Show response
b4ba14939050c43d313cd95dba797c63.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2EE8 6 KB
4 KB 70ms
15ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b4ba14939050c43d313cd95dba797c63.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 04:48:06 GMT
expires: Thu, 20 Apr 2023 04:48:06 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 41ms
20ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame AE01 13 KB
5 KB 24ms
7ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 26680
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 19 Apr 2022 21:23:26 GMT
expires: Wed, 19 Apr 2023 21:23:26 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F034 783 B
1 KB 38ms
17ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cb102c0802379e5d4219afa3acac37b939bf1b12379ab2a802cc8d29eb601baf

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YwzEGzS3Qs7/Y4tcLzvnAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-YwzEGzS3Qs7/Y4tcLzvnAA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 04:48:06 GMT
expires: Wed, 20 Apr 2022 04:48:06 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 64D3 0
0 43ms
43ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskTM4WdU54HlDEfwDhOHYKjUXpeTOCymG1hMwz1CxWx3szZ6IbVv7uX1pIo-NO3pVQiR1ur0noQalqavWOqlHjp4QDw2D9q2IAcDV3elYg7Obl4bKnC8VGjW8t29h-QeJk9me-BvBLU9qAs6e6IUOByrwJt6Zjgg1JXHlBKaEyUw3ZBsERH7Tibebgye5qylOLlscP96gkmqtQ3Er0F3Sg7TRLYGSwufl6OMDGrcfoTmwxMvklVALKFpghCETTRIB69I2_oATXlYaNprsy3rG-a5KHtpjPggV7RZYCEiJZEZ89vuOeozcAaKZEdY3QuetnEHDQJGpGSjlstyc&sai=AMfl-YSwAQBBjc209nKBYeOhOdFRHRJF6v950M0cgwx6sY45UhS6lun94wCCSVTu_hUaLUbpJ4AxmHe729_lsQXQESy_Xz7Kq0CF9rCP8vCVJRYg1G-yhx3w9LNSUmf_4X3r&sig=Cg0ArKJSzDHlge-Ns0SkEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H2 200 prebid-universal-creative.js Show response
cdn4.buysellads.net/pub/ Frame 64D3 26 KB
10 KB 8ms
6ms Script
application/javascript 94.31.29.32
STACKPATH

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn4.buysellads.net/pub/prebid-universal-creative.js?1.13.0
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.32 London, United Kingdom, ASN33438 (STACKPATH, US),
Reverse DNS: 94.31.29.32.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 63245f596844239425e7d2ad61924338b491e57a2c5515763c7e39ee1f7ad551

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
last-modified: Wed, 20 Apr 2022 04:36:09 GMT
server: NetDNA-cache/2.2
x-amz-request-id: XZAG6ZZ708YPP21D
etag: W/"e87666218154f656d055b609e6bcf7d7"
x-cache: HIT
content-type: application/javascript
cache-control: max-age=31104000
x-amz-id-2: J9aHIhiuxcBJgOXoUAghHnYfHKA6L5P4sAJorK7Hf3zM4RRhnEfqaPf5tMUfCINvDaCpS70vGl0=
expires: Sat, 15 Apr 2023 04:48:06 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 64D3 119 KB
36 KB 61ms
47ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caa2b4b885d62d25d986de63c6e3163f9c7da374d9b76bc4a412b61d4f2975d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650281421154365"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B634 0
0 44ms
43ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssr72HbHs2k0PHVS38Em4lnIBn3OuPJHv6MbCw48BNhcvAKG36rZjKi86WmQ9sXvgYw0T9gxFPx6tex7IXDAa9Ydzvtp8WnzsrtLSi1ymfBaaT-Jw-IguqXbihIekZ6LeV0n-84xiY5zguMld3DBrxsekuZrq4fAL4XHaUSIGinuBRMUA19c0xIofHNrUK2M_WFtsUx_KtIoRp2PCWp9wInJhaaMQhvFjPZbSJG-qOQPVstwIgU4yXPMyxEbqGYDrbIzBSSXKPNl8NKHQGD8Oi_CdDbPPzuBxdjgNnwiih6WUPLpxLKYDyYDT5dTDTCsk6n3HbuDx3_-LE&sai=AMfl-YSuTpOak1pJ_JdoMBytFgj2RRQIdSY3BTRkaQ6E28fiW3uaALhqhfs-ANhgtw0UCev4gJnI4-vZqng_WL65Q6vAu6AXKRFRcJ-QKdK0TuvjcH3vBSxvE1KjlvfLHzim&sig=Cg0ArKJSzI8c3zT0SvzqEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame B634 26 KB
9 KB 52ms
23ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 26722
x-jsd-version: 1.13.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19162-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6U21xk6KmYRmt4FvUR3biEMi4tIsXw5c9taBNGuRAemv13aIFBOvtN%2BPwvgxr54OSlZXSWV%2BG99XHkgfwqNNCLcPd8p7zrA88JXB1PmYUzKGa1ZV4Vr6HBv95mL5MP15Wvd6roOwo9M%2FgxCZFQY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6feb3ee77e60cc42-ZRH

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B634 119 KB
36 KB 53ms
42ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caa2b4b885d62d25d986de63c6e3163f9c7da374d9b76bc4a412b61d4f2975d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650281421154365"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7262 0
0 41ms
41ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstlozMyMD_t67bN6SJfOFiN_55xhWBOgyjC-EgNBYky-mvEOUxUVfMifek_nPse1F3uJooAPcck6Y14X3v-n5LK8yqp18UV-55BFQXMBRKGKYAnli3ezM81CrX8s9LUGXRPzh_gIJEMJdEmp23vhOp7IibsDi6ayK37dqp9Y71ySDSiApOFbF7_AOdSlIh7DeNeB74ji4kh_C5vCbrGe-RUbJXaFe-JN-p1wy9Nh6veuvRYbrXcVTiJYq0e1my7gnr5qc7oDJ_00sfLQCx4BmfSwTRTeRg8G6jg-ET5tRNyGJDJSadCpopMo9L04mM53hlQahBaohUTluE6urU-a7p9P6aDrGnB&sai=AMfl-YT1AIxW0W4NhqQdJF5C0VadQ9hmWsB3pRy1Uw3pp4kK40FKvz3PPGNOBsax1Kjp_uWtFH5VlywrHMHrxOpaRnbUDDhqNPAsVTtmqLIsb-EknNp7r67gfOoYCjSzvDYv&sig=Cg0ArKJSzPa09PNd-GtQEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 7262 26 KB
9 KB 52ms
27ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 26722
x-jsd-version: 1.13.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19162-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=95s73McaHb5bTEseLqmASFOv7NFbaQ7EaCIB0%2Bl%2FrPJFzvfcjJmgnMoY99mvpAwojqqQpOgNZ8C1m%2FRhUU7ixWPUOSzbYFORHS3%2Bg2fNlXGkGN4y0VLQCtLBaoLXDJzKDooCq0TYNh1yzZnBncY%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6feb3ee77e64cc42-ZRH

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7262 119 KB
36 KB 52ms
45ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caa2b4b885d62d25d986de63c6e3163f9c7da374d9b76bc4a412b61d4f2975d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650281421154365"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 77C5 0
0 41ms
41ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssvAwCW_Sjq3UzqhuSgurgMQGwckFaZGG3FaO0iMNEZOn2tzxGl-NNA6aO0EmTQDDs9AeYie58zLzIz0_6W1QAJC9dpMyZ6gGQjW4bcFQ70sds67bWiU_3IBXF1ZuFJdGYZbPh4fVJVi0PFqeQSE0Q2r44YgDAeHcAIJWNDUkH8PZkXioYqgUv7rnDdYLok5z221LE4twHzqIIJ6V1dTV9flGq3dmOgOaE1gvSOvpV42297wHxM-BPSldrhevoU2HYIvmAovaIUkYjBHZimsEs3CeJmsri649nvlaZGJxnet2wmGcVqO7xQu1A3DqnZYVvL0HVzUGQkskDvHzoOiznbpA&sai=AMfl-YRD2Q4pEm2mTuNbIJxaxbdk-x2-JV5EEfSL_OXPQl-CuCp0tGEzqecdF0GmAgw82WURK1N7cGWfCmlror_YfXW-qXXurbgdhoVd4JY8mtHZ-FMWRhfdk7YM2giKsctq&sig=Cg0ArKJSzEMTt6QPUkZgEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 77C5 26 KB
10 KB 43ms
21ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 26722
x-jsd-version: 1.13.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19162-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5m1niLDycZg99gPio0ii8JN%2BEPKfBXYZh6MfDdP5%2FP6C8Fv0WrhI23ishPOhg%2Fn49Vj0Spia8R0Eqj2fUlTO24hpQmPHm9Z90Ov1QjV34%2BkPryAez0qcm7IffPfVfj2%2Bm8x%2BqCDtenFQL1pkxio%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6feb3ee77e63cc42-ZRH

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 77C5 119 KB
36 KB 34ms
30ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041301.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caa2b4b885d62d25d986de63c6e3163f9c7da374d9b76bc4a412b61d4f2975d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650281421154365"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H/1.1 200
OK script.js Show response
acdn.adnxs-simple.com/strikeforce/ Frame 64D3 114 KB
40 KB 78ms
6ms Script
application/javascript 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 24d3345526f5bb7cdd3e21a689dfe8ea413e989f45fc964b86ca03554e684bae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 04:48:06 GMT
Content-Encoding: gzip
Age: 84174
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 40598
X-Served-By: cache-lga21933-LGA, cache-hhn4046-HHN
Access-Control-Allow-Origin: *
Last-Modified: Mon, 04 Apr 2022 18:58:56 GMT
Server: nginx/1.18.0 (Ubuntu)
X-Timer: S1650430086.377028,VS0,VE0
ETag: W/"624b3ff0-1c7dd"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 15 Apr 2022 05:25:03 GMT
Cache-Control: max-age=86402
Accept-Ranges: bytes
X-Cache-Hits: 3, 79605

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 64D3 0
20 B 53ms
39ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-C5CnB-0u5FqFQ6HPw5JpGKLgOckQybOIwuu0DpBaZWilxCYpveCYEXqKlMMJaBqGSXt7CF0N98jf8MYxWYDqqgVElLlQ

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 64D3 11 KB
5 KB 31ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd97a5bac90d9e2f62d8ef7ff715c53c56312bcb2ddde01e3454485ba317df37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:24:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1405
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4875
x-xss-protection: 0
server: cafe
etag: 7698967424627035244
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 20 Apr 2022 05:24:41 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 64D3 85 KB
29 KB 88ms
19ms Script
application/x-javascript 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 04:48:06 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29216
Expires: Thu, 20 Apr 2023 04:48:06 GMT

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 64D3 0
814 B 78ms
42ms Image
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwheregoes.com%252Ftrace%252F20222118233%252F&e=wqT_3QKJBugJAwAAAwDWAAUBCIWh_pIGEN-Bqu2jtN78RhgAKjYJ7QvohTsXrj8RJKO5BJYSqD8ZAAAAANej4D8hJA0SACkRJMgxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreIjbBIABAYoBA1VTRJIFBvSFApgB2AWgAVqoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgAp_wP-oCKGh0dHBzOi8vd2hlcmVnb2VzLmNvbS90cmFjZS8yMDIyMjExODIzMy-AAwCIAwGQAwCYAxegAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUM2dmRVNWEyR2MzS3JubnhNV2JkUHpuY2tMeHg5Zmx1RkM3WktqT05tOXBCbWIxY3NEX19WajJfeHhobXFoRkJDYUpVSEszckJPNXdvRm9SV1lONm9QQ1FxcDhRJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzUxMTQyNTI1ODk1ODIxNTU5OTkiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA0xNDYuNzAuMTE3Ljg4qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdjx2OjQnbORPMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcyQJfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMDYxNTcxOTI3OTa6Bw8IABAAGAAgADAAOLYYQADIB4jbBNIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHuIkMiggCEAA.&s=88f7af388cf39bef689bf9f6f037ed3087643d3e

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:06 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2f7833e3-15e3-4d62-ac74-ebe716fb3c76
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 l2o4cWLNalU19nN7vA12WZhb1qS4KDqIWPmZT-glBuk.js Show response
pagead2.googlesyndication.com/bg/ Frame AE01 35 KB
13 KB 14ms
8ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/l2o4cWLNalU19nN7vA12WZhb1qS4KDqIWPmZT-glBuk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

976a387162cd6a5535f6737bbc0d7659985bd6a4b8283a8858f9994fe82506e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 21:22:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13574
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 21:22:49 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F034 0
0 65ms
60ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022041301&jk=4302344040976430&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 77C5 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4cdab7bcce735ad27051b0fbad55c8e58c4b9e8a6accd8f39c398fd731bacb47

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 77C5 0
0 57ms
43ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssqrvDTMYtMWjB_QwQAQCLhbnss2wMBubvXhd1F35KWIXdA3daktx0ConqgzxirRVW9wk7VAH0NztU5s5rrmI4UHczhCs_J4OLKF-BC_VQCgK59YmWXl4lNEn69nOly3kUCoq86lp5WbCwgDbJ9rJ92l8Ts03FSpMmDGa6WGYfsYUnezTPunUBzGcgLyf9QryfbomoYVvTcPpIcoN8HzfZfylMZ0GxvN6P_OgbvvbwNfyKKKSfzG882PiAy2uPykyfvk1JsQwA_3NSUpZ162T9NOb8kdAcjvZR8N4SYZWrlWqlBXlpnaeMe0E4C_lc-taLgoEjEvLOMsKNwPfnzt6JvHe3S&sai=AMfl-YRK08r5LPim4Q2zx6ZsxTzLSfVzZngosEhdiiHw0QCcrbmXzL35mphVIH985d0FUU8bAbVZx70yqnQqVaOSJ44hXix5NyHjYkDzJPeVSgzQ8yFR7H-SjFLww0EcSvYX&sig=Cg0ArKJSzCxNypXsPwvYEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

OPTIONS
H2 204 1a
i.clean.gg/ Frame 0
0 124ms
92ms Preflight
text/plain 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://wheregoes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=utf-8
date: Wed, 20 Apr 2022 04:48:06 GMT
server: nginx/1.21.6
via: 1.1 google

POST
H3 200 1a Show response
i.clean.gg/ Frame 64D3 0
15 B 110ms
95ms XHR
application/octet-stream 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
via: 1.1 google
server: nginx/1.21.6
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 3A82 13 KB
5 KB 22ms
7ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76699
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 19 Apr 2022 07:29:47 GMT
etag: 12223946614886178233
expires: Wed, 20 Apr 2022 07:29:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK rd_log Show response
ams1-ib.adnxs.com/ Frame 64D3 0
814 B 66ms
66ms Script
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&e=wqT_3QKhMughGQAAAwDWAAUBCIWh_pIGEN-Bqu2jtN78RhgAKjYJ7QvohTsXrj8RJKO5BJYSqD8ZAAAAANej4D8hJA0SACkRJMgxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreIjbBIABAYoBA1VTRJIFBvReAZgB2AWgAVqoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgAp_wP-oCKGh0dHBzOi8vd2hlcmVnb2VzLmNvbS90cmFjZS8yMDIyMjExODIzMy_yAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhcKCklGUkFNRV9LRVkSCTI0MTAzMDQzNPICvxUKC1BSRV9TQ1JJUFRTEq8VPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmO3ZhciBrPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bgmOQGEsYyl7cmV0dXJuIEFycmF5Ri0AEC5jYWxsASkwLHZvaWQgMCl9OmZ1bh0_WGlmKCJzdHJpbmciPT09dHlwZW9mIGEpCVYRGgAhFRpMY3x8MSE9Yy5sZW5ndGg_LTE6YS4NmFAoYywwKTtmb3IodmFyIGQ9MDtkPGENKVw7ZCsrKWlmKGQgaW4gYSYmYVtkXT09PWMNaAggZDsJcSAtMX07LyoKCiCaOgERzDggbChhKXtsWyIgIl0oYSkNTgggYX0JEwA9ESgQKCl7fTsRDQQgbgE1BGE9KRo4PT09YT9kb2N1bWVudDphFUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJV5wZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTshLBRiPW4oYS4RfAQpOyEpBCl7ARoAZS66ABkXBGY9WlMAPCxnPWsoZixiKTswPD1nJiY-FgIUc3BsaWNlSRV0ZixnLDEpfWIucmVtb3ZlRXZlbnRMaXN0ZW5lciYmUhcANCgibG9hZCIsZSwhMSk7UiMAYjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAFtPhQAACg2agAcYi5zcmM9YztaMQEYLnB1c2goYi7RAQRxKCl8BGE9MZI0LmN1cnJlbnRTY3JpcHRNGgAoMjkCLG51bGw6YSkmJiI3N2FJbGEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FHfBGcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTt5KwB0FeAAaAVhDGM9W10FCQRkPQHGDDtkb3tBexhiPWE7dHJ5BQwAZUGTGGU9ISFiJiYBJFAhPWIubG9jYXRpb24uaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AV4IZj1lGRcAZgEWDGlmKGYpeQBnPl4ADDtkPWJ1HyH0NUIkcmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_TH19d2hpbGUoYSYmYiE9YSk7Yj0whdUAYZX2dC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAK04AD0ddQApoVsUYT0xO2E8sYBMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBoGash1WXlAGclFiUCBGQ9MgQBHDA8PWQ7LS1kodhIZj1jW2RdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBkFeYEJiYBzAE7BDswQWUlWggmJmQFSAEbCCk7YwWtEHYoYixntegUYy5nP2MuBfoMOmMuaQFAAH215gB2oaEcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQq9-gB3dUkUdCgpLGM9-Qo8Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4IKX19Dg4JFtYIKCAwPD1jP2Euc3ViFmsJHCgwLGMpOmF9CeAMLnJmbC7oBw01aGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtQzVDbkItMHU1RnFGUTZIUHc1SnBHS0xnT2NrUXliT0l3dXUwRHBCYVpXaWx4Q1lwdmVDWUVYcUtsTU1KYUJxR1NYdDdDRjBOOThqZjhNWXhXWURxcWdWRWxMbFEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqAZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDFhEMCIgBPClqNggBFvYJUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZQlLAD4NUwA-nSRgIHtyM3B4KCcyNDEwMzA0MzQnKTt9KSgpOz3qEPYTChBIAZ00UE9SVF9QQVJBTVMS4RORI4qUAPB9YWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTE0Ni43MC4xMTcuODgmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9zRYogX3N0YXJ0PTEmoXURu34FDhAmc3ViXw2YAGJBnvB9ci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1Ld2F0QUNQRzdRQWtCdTBBSkVidEFDWkc3UUEtVlUwQVE5b05BRVhielFCeUhJMEFhbHpOQUZZZERRQkVIVTBBU2gxTkFGTGRUUUJkWFUwQWVSMU5BRlVkalFCYm5ZMEFiVjJOQUc3ARAsdlhZMEFjcDJOQUhrARBsQm5jMEFSVjNOQUVYZHpRQkpIYzBBVUYzTkFGRwEQBFIzARAAbAEQAEwBEABUASAEVk4BEABVARAYV1hjMEFWNQEQAGcBEABZARAEV0oBEPRFCUxjMEVCVTNOQkFla2RYQUlhSGx3Q2V2bUlBdEg2aUFJblFxb0NLRUtxQWlsQ3FnSnNWS29DZm1LcUFtQnlxZ0taZXFvQ2dvV3FBZ3lIcWdKR2lhb0NLSXFxQXJXS3FnS0FtNm9DZ1p1cUFvS2JxZ0pEb3FvQ29xaXFBaXlzcWdKaXJxb0NCNi1xQXM3SHFnSXl5cW9DeHN1cUFvYk5xZ0tHMXFvQ2JOaXFBanJacWdMSjJhb0NvTjJxQWxYZXFnSl80cW9DeU9LcUFzYmpxZ0lrNWFvQ29PV3FBajdxcWdKNzY2b0NqLXVxQXFYcnFnTHE4S29DQWZPcUFvM3pxZ0liOUtvQ1dfU3FBcmIwcWdMRTlLb0NEUFdxQW83MXFnTGU5YW9DOVBXcUFsMzJxZ0s3OXFvQ3BfZXFBbFQ0cWdLcC1hb0N4UHFxQWlYN3FnSkItNm9DWV91cUFwZjdxZ0xTLTZvQ0JfeXFBa1g5cWdKSl9hb0NEZjZxQWl2LXFnSlZfcW9DWVA2cUFvTC1xZ0kyXzZvQ2JQLXFBblBfcWdKM182b0NmZi1xQXBYX3FnS1hfNm9DOFAtcUF2cl9xZ0l4QUtzQ2JRQ3JBdUVBcXdLRUFhc0NMQUtyQWpVQ3F3SnJBcXNDZEFLckF1d0Nxd0lvQTZzQ0RBV3JBZ2dHcXdKaHM4VUYwWVlqQ29XaE5SRURyUHNTUGJYN0VpSEYteEpneXZzU2dkcjdFaExnLXhKNTdmc1M4TzM3RXNfdS14S3A3X3NTSlBEN0VxbnoteExzOF9zU0VfVDdFdEwwLXhMLTlmc1NCZmI3RWhmMi14SXk5dnNTVHZiN0VxWDIteElaOV9zU21QZjdFcVAzLXhMYTlfc1NXNV9xRkp6TEhCajZWbXNhV1FDU0tiR1NRVGsmZXhrPTI0MTAzMDQzNCZhd2JpZF9jPUFLQW1mLUFlXzNjNVhyUW1HQWZaVjREUFl6ZDI2V3U4Tkdxcml1ZGJpU0ZVT1BtWmhMLTlKNGdKSGdmRjdLQVU3Ri1kX0dhN0Rwem81U285cmNZU0l1Z2pYcmM3YzN1QzVJeUVsVzBFMTA2d1Q4Y3M5VjJXUEw4LWVGMUk4S2Q0UDBweHdLX3phQzRROFAtbDV2MnVGSkFFNWRaTm16eEVKeHA4QTlSUGp1T1hpZnNFdkFlTDRMYyZhd2JpZF9kPUFLQW1mLUJRbF9CMy1yb0VCaThDY0V1MXRYbkhnVkljdmtlU1ZvdmZsWHJFQmVDNHZuSktWZ2JBLXRLa3pRTjR3S19xV01CSGp2MkVZLTY0d1l4cnZFM3djRWVXSnBJazNmVnY4a0hDZWNUMHBYdE9MSndSYzVjazNycF9zVTNhcHVWY0hVRGlVZVE2bW05V3pjeW5PTTlrWnpsNGowZ0VZTFJzdGNzU1lQMGN2Vi1UdXN0V2RWOWlOUmg2RjFDWjh4ZzA3cHRmNWNIT09vV01KUXF1NkVvU1NRay1Cb0E2TEFfYkhTWVo1VGxrNk1mNWEzM2tteVc4TUk2SkRsSU1HUUtvNlZIUk81cWJobWpiWk8zTUY2ZzBoV3Z3WUhiVzAtWmUyUlVvTmdqOFpRLTdidk9mYjFwQm9IYmtiWmhOOTdDLVJKZ09xYkN1TENDbEY4WFRUMjM3akdESEtDaW15a2k0MXV4T3FFU3JuSWh4Sy1ZZmJ6THpiMVVYX2hEYkFBc1hzUWd3MmVYQlZaRGVGc0JNUU13Wlh4N2J1YkYtcWxGVUVRdEJWZTVwMzRWS1Axb1dmMGpMcjRIOHk0Si04YzFDWmNpZnU1dkRYRHNCSlZlWUdNbnhTeXg5VVc4bjY2WHpMQ01kcUZqOEZIdzYzZ25pUjlUMTIwNGRWYXp5dlRjNFNiMHptRTZabUd6alV3cmRLSGVGZy1pX0pfRVlDc1hSMDhOZW5Ma0RfNFc2ZHN6NzM4cm1zS0s1MDhXY2tEc2lXZHRfUlIwVG5fOG54MUxoY0g0SzhtdjIzU296amFNa1gta0ZRUERrTVpuQ2FYME9aNnpDenplc2U4REp5ZnJKTGpTeFJkaFd1VTMyeGhfZEtfd0NDREwyb25Ub0dlLWh6X3FaOFNLZzVhdnY1aVdKQ1JEdnlEZmZrUC1xaENVb29aaGNGdFBwYlJOZFlMZXA1Ulp2SnVRVi1aclFNenQ5MXdmWTJTQ0xOTWNzX01XdllrQnFRSURtQzBfc01iMUdONy1NZWdMRTNFYmwxZ255WjVDWEc4MUZ0WVNkX25jSl9nbG9yZjBHMmFMZ1pnOE9nM0lUMlR4d3lrY3VoSldIMEtVVTVTb3hYQnFCcFYzZFZ1dVdHdjNCUjNJa0s3MDVZbUhtTjk1ODcyZ0R5bzZ0dEc1NlJ2M3lyaElGWlR0WnFUemtlaW1WSnVHd2NYYjhHbXB1OGYyTzFEam1ncng4eVdRektCX2lSblJ4a3NkdW5vZE80TC1yallibTVuVnlKRzc2eEdOZjNpNmFlckphbzFINXRuOERjak1FVXk0QlF5Tnh6d3dVYkM0NU5EbkVLUV9ESmoyN0V5N3d2anVTZXNvUFh6RDNhd3hCR2JwSzJ1dlA0SWlmLTBqS01McEZOcW16SFFzNC1yMHN3d2xHR0cyU0YzUmJHRGpzeDBsMzhwbVBnZ3hyQ0VaRWx5R3Z2a3psQlVxS0JGeU1NdyZjaWQ9Q0FBU0JPUm8wTUUmYV9jaWQ9gAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA0xNDYuNzAuMTE3Ljg4qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdjx2OjQnbORPMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcyQJfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMDYxNTcxOTI3OTa6Bw8IABAAGAAgADAAOLYYQADIB4jbBNIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHuIkMiggCEAA.&s=b0c76638b3ef776925655ed0dd8878b27b736459&bdref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:06 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9ecb0074-5b0f-4856-9d9a-27c1f4462e25
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 7262 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b8a2af5656fb29caa5759d0694e903463b8647887ccafa113f26398464129a46

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 7262 0
0 44ms
43ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu6cLWXcjd3kuUk8ybPjFO9oJPuZSFpSXVlRNgUV_m3IH6cBkRkaMOTrUO6kjBIdUwp2hRQpOExpSmlUvbWslgCMlU0WmuQfTxooPPq3k2ZFheuyQzzZ0QzJP1M6RQTVym8s2WFpz3pJrzY7pF_nsVZafdgxmCCO1y0ZgNdkb1TFmSq0STKVVdBdPRY8tt9cz81cXts_in4jWj6fayBM6Og34seSOsfl49wwym4oS8h2Ks-TpRtjigZ4eMhCs8goWrPoYgc3n4pdJdZLpQHsSEs7Y5fm0SEcKqbPqJ70cR8QE5ZMyo-GSLx_ngrEcpe5hKaIsXwzaXUuhMTNpUaZbHoNZ33O2R85w4&sai=AMfl-YTjpJ7sx0CSEU3SyXyJ4uAIFyUJjE1txb9LYNrJ0ULXm9JFftSxa3KS3pxOcEdhgzHiODxCp7MHDzuyQ0oyYewGvPCJFM7wRSp4_6Mo5c-JMIDdUZV-CDHTWhYqDLL9&sig=Cg0ArKJSzBAn-w5kNVuGEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
DATA 200
OK truncated
/ Frame B634 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dd1400bbda98abb62666ace96ead9ac231ed59328cc22edc6c8b30b07883cb4b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B634 0
0 41ms
41ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstB0AOghoSSovNk0y9zvDbKK1-qr4ui2ESZv3hVNx7khwvf-SK-NjJg6WhsYNAqT3pZLXkRORkStqym9Vgt7AdVuPTiYag8hvEXuxeOO6Bm4DDJxz9MugPMxac10AmGp0zLF87xACvlgUHpKkDiDpvzQOU1l-1qojQD2Pb8TChov_6OVT08jSsiaXnN-o08DE_D0rrNjWvgBE0hZdGfVOLi1re3G60AFqw4ezYskUWPbgRnfliW_ENW7-fDrAv36_nEi0vKWz_LJZn2F7wqFmbov43B0PjCZGgAjYA2G3cDpOMcAIGjD6MXulhB4brEXdQ6ZYPhObpbMVVsEw&sai=AMfl-YT2mLQHc9KCWu3shUOzCLZ3ELSnQsgJWMN2ZAzJ21qxz1BxpfmJMtK4lwPrO4CducVHQRFk8hM1kvflLGYMWCK8MKhiZTBibgjBOVgDKNTBwpgFY4-MesAtCnHwMvCr&sig=Cg0ArKJSzGPuHU61fIQgEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 2AC3 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76699
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 19 Apr 2022 07:29:47 GMT
etag: 12223946614886178233
expires: Wed, 20 Apr 2022 07:29:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 52B9 11 KB
5 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cd97a5bac90d9e2f62d8ef7ff715c53c56312bcb2ddde01e3454485ba317df37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:24:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1405
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4875
x-xss-protection: 0
server: cafe
etag: 7698967424627035244
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Wed, 20 Apr 2022 05:24:41 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 52B9 85 KB
29 KB 24ms
24ms Script
application/x-javascript 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 04:48:06 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29216
Expires: Thu, 20 Apr 2023 04:48:06 GMT

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 52B9 0
814 B 51ms
24ms Image
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwheregoes.com%252Ftrace%252F20222118233%252F&e=wqT_3QKLBugLAwAAAwDWAAUBCIWh_pIGELmnwpPrsbf2FxgAKjYJwQKYMnBAmz8RNALgjibNlT8ZAAAAANej4D8hNA0SBCnBDSTIMQAAAOBRuJ4_MPXtsws4ykFA5R5IZVChn-kkWJjVUmAAaM_4a3iI2wSAAQGKAQNVU0SSBQbwqpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjIxMTgyMzMvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYQEG9AUBX2I9QUtBbWYtRHBWVTYwRUlIUXJCZDdIZmdhZVVHN0Y4Wk9CWHJnbjRuTlQybjgzN20xNE16VG90dlBWcHFNak1La0xYczRDUW93d3lJc3J4WGVlZFFYS0Y1ZktSX214cGlQb0EmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTcyMzk5NjM2MjMyNDg3NDE2OSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDTE0Ni43MC4xMTcuODioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBCHWVIgFAZgFAKAFvaCM6Mb0vMJAwAUAyQVBIRwAAPA_0gUJCQkMeAAA2AUB4AUB8AWapkD6BQQIABAAkAYAmAYAuAYAwQYJJSzwP9AG7o8B2gYWChAJEhkBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMzkwNTM3MDUyOboHDwFYSBgAIAAwADi2GEAAyAeI2wTSBw0VhgFHCNoHBgknROAHAOoHAggA8Ae4iQyKCAIQAA..&s=04bfe93f98b3e02506caeffa419ecee6deaeeac4

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:06 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ba4f30d3-00d7-42a9-857a-1c096254fe8c
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 52B9 0
20 B 39ms
39ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-BvuqxS9qdtJcVv_fPpVHuZSOj6t4erSuIr3pJEFvfr84xEkr6YQnssiYSrZ5kEf9ThbbMjYaQisBoTenWH38R7GeXSEA

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame D3D8 936 B
1 KB 66ms
17ms Script
text/javascript 37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=48267046;rtbwp=0.237705;rtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

0b479eaec50615d4f09e6d223d81d2496e644da2182cac91ee1c7873e53be341

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 794
expires: -1

GET
H2 200 talon-1.0.40.js Show response
cdn.js7k.com/ix/ Frame D3D8 69 KB
17 KB 51ms
13ms Script
application/javascript 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.js7k.com/ix/talon-1.0.40.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b3a1231790be53aa5210678e207c61bc8376c752f0c5a33df9e3eae23cc3b0a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 02:48:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7167
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 16540
x-amz-id-2: V+07ZRgD/1W5H8lyJA8XzSeY/+lEAPRSMq8AYgc6PvUFLyafM/+qoPJ4RU4hgoqU/8GqsXxRygE=
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Apr 2022 16:08:42 GMT
server: ATS
etag: "adf514fab5c3f95007c73e6c3c901bfe-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: Y621BHTY7AJ8DEZM
x-xss-protection: 1; mode=block
cache-control: public,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 adEvent.do
prod-m-node-3113.ssp.advertising.com/admax/ Frame D3D8 43 B
176 B 45ms
7ms Image
image/gif 35.158.6.230
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prod-m-node-3113.ssp.advertising.com/admax/adEvent.do?tidi=770946938&dcn=8a969544017c7c276e6e27f4ecfe0019&posi=1583365&grp=%3F%3F%3F&nl=1650430085832&rts=1650430085744&pix=1&et=1&a=92aef25cb39e475a996d2022386669d1&m=aXAtMTAtMjItMTIyLTE1NQ..&p=MC4wMDAyMzc3MDU&b=MTMzMjg7NzIzNjtzcG9ydHdldHRlbi5kZTs7OzsxOTI2MzRmY2I2N2Q0YjQ2YjhiMzcxNGQwMzk5YjM1YzsyOTQ2NTEwNDsxNjUwNDI1NDQ5OzswLjAwMDE0MjYyMzs7MDs7NDgyNjcwNDY7ZTkwZTM1MTYyODFkNjYzMGY2MDI2ZjZhMjFmNjlmMDQyYjUyYTI3Mzsx&xdi=Q2hyb21lIC0gV2luZG93c3xHb29nbGV8TlQgMTAuMHwxN3xEZXNrdG9w&xoi=MHxERVU.&hb=true&type=0&af=5&dety=2
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.158.6.230 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-158-6-230.eu-central-1.compute.amazonaws.com
Software: nginx/1.20.1 /
Resource Hash: f28236cf9fb53f0f4f4f35faf320aafaebca7c2f0679e6f13f8a4283ec5ed10b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
last-modified: Tue, 19 Apr 2022 17:30:36 GMT
server: nginx/1.20.1
accept-ranges: bytes
content-length: 43
content-type: image/gif

GET
H2 200 BannerAdBannerPlacement.js Show response
onetag-sys.com/static/ Frame 1317 28 KB
9 KB 9ms
7ms Script
application/javascript 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.13

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

1c0540df83bc5acde994b221d7524c2070829162d1179d2f54f404b7c94223d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
expires: Mon, 01 Jan 2046 12:34:56 GMT
cache-control: public, max-age=2628000, immutable
content-length: 9399
content-type: application/javascript

GET
H2 204 lXwKCPe1ERED7wbFvmmp3C60tbfHxwES-4YrtZkbTrf01KATJWUQoB-Ramra8htk485zM_our9YIRsNJODsedyPQAZauKNX4b6UKzI69fwPbS_kmz01FWxRQok_y9gAew7L2uZGZhtaCGZGMC8fZBFlMBuzb4zoI--ASqCsN30L2w8Ufy8JOSRLoYbXKXQhmaIqbz...
onetag-sys.com/ping/ Frame 1317 0
28 B 9ms
8ms Image
text/plain 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/ping/lXwKCPe1ERED7wbFvmmp3C60tbfHxwES-4YrtZkbTrf01KATJWUQoB-Ramra8htk485zM_our9YIRsNJODsedyPQAZauKNX4b6UKzI69fwPbS_kmz01FWxRQok_y9gAew7L2uZGZhtaCGZGMC8fZBFlMBuzb4zoI--ASqCsN30L2w8Ufy8JOSRLoYbXKXQhmaIqbzq-Tkdde4cHMUul1Rw;M877-58yCQPJYq9qTFB9afYs0EdEOpCgptWCJmA4IDA:jiit0vVpqBPmMGlyjXPTNXoLWet8Sj6SyzxLJ-FQwqi2jwcAitc9rViv11M_biSqbuKwaZdGooVsLbp-xTTgds_u2dCFl5lABrusn7mrxqklkLhft72Aio1gUs2zRTHJkW1NezFrhmlhBcd53ZQqnqx-YSdg2AuGgk_8TwuLE0L704SxatKJUjaEyKM7sCFB9UCekRv6EbD8VSr4ZIRHAmJd6Kcx9OIK7hQezKviRaG3H_bjW5jm6k_exPO-IqfA5WC6kg3KCnwmi3oqj0D-2fKgRKLgFK-8f_HS-Yr7YWxOqmdzX7-hQfaWnd-_JajOoUcqFB72RkU5oC6Z3suIjTJY5j-IdWErKimdteBYEPO-d5N-JQ2MvHYFv0J2PdOHKtbZJFfuRXxZugLWht7bptQWTljcwKxNQogwXbw4jkKvgOaFdits6sJGGiuMLHiFbfjgVzrFUIU1tXzWNZmO_0mVfnYTToS9dxSZlDCxBV0ktmUT1YG8R7s6Xidsep8rg6u8nsvY_NS3XcE20a7-eyX6jVarOQyYv1TsuYOJtDwUNKIgzsjqiSKU5O-da6azwQLawnYUs2iK05-W41RXmnwjCE1InCe2_eWzqT8YUIowss2HoV2-fEskCdyCCy2h03oopY3L2fRMo1bdrX7__opQKpuskWPiQSCp99gZ_GM:115:0:0:0:0:0:0:0:c81e4b7d-58dd-47db-8918-20d283932058

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

GET
H/1.1 200
OK rd_log Show response
ams1-ib.adnxs.com/ Frame 52B9 0
814 B 15ms
14ms Script
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&e=wqT_3QKhMughGQAAAwDWAAUBCIWh_pIGEN-Bqu2jtN78RhgAKjYJ7QvohTsXrj8RJKO5BJYSqD8ZAAAAANej4D8hJA0SACkRJMgxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreIjbBIABAYoBA1VTRJIFBvReAZgB2AWgAVqoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgAp_wP-oCKGh0dHBzOi8vd2hlcmVnb2VzLmNvbS90cmFjZS8yMDIyMjExODIzMy_yAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhcKCklGUkFNRV9LRVkSCTI0MTAzMDQzNPICvxUKC1BSRV9TQ1JJUFRTEq8VPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmO3ZhciBrPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1bgmOQGEsYyl7cmV0dXJuIEFycmF5Ri0AEC5jYWxsASkwLHZvaWQgMCl9OmZ1bh0_WGlmKCJzdHJpbmciPT09dHlwZW9mIGEpCVYRGgAhFRpMY3x8MSE9Yy5sZW5ndGg_LTE6YS4NmFAoYywwKTtmb3IodmFyIGQ9MDtkPGENKVw7ZCsrKWlmKGQgaW4gYSYmYVtkXT09PWMNaAggZDsJcSAtMX07LyoKCiCaOgERzDggbChhKXtsWyIgIl0oYSkNTgggYX0JEwA9ESgQKCl7fTsRDQQgbgE1BGE9KRo4PT09YT9kb2N1bWVudDphFUMkLmNyZWF0ZUVsZQEZGCgiaW1nIikdRQBwJV5wZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTshLBRiPW4oYS4RfAQpOyEpBCl7ARoAZS66ABkXBGY9WlMAPCxnPWsoZixiKTswPD1nJiY-FgIUc3BsaWNlSRV0ZixnLDEpfWIucmVtb3ZlRXZlbnRMaXN0ZW5lciYmUhcANCgibG9hZCIsZSwhMSk7UiMAYjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAFtPhQAACg2agAcYi5zcmM9YztaMQEYLnB1c2goYi7RAQRxKCl8BGE9MZI0LmN1cnJlbnRTY3JpcHRNGgAoMjkCLG51bGw6YSkmJiI3N2FJbGEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FHfBGcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTt5KwB0FeAAaAVhDGM9W10FCQRkPQHGDDtkb3tBexhiPWE7dHJ5BQwAZUGTGGU9ISFiJiYBJFAhPWIubG9jYXRpb24uaHJlZiliOnsBLZBsKGIuZm9vKTtlPSEwO2JyZWFrIGJ9Y2F0Y2gobSl7fWU9ITF9AV4IZj1lGRcAZgEWDGlmKGYpeQBnPl4ADDtkPWJ1HyH0NUIkcmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZCwNywBjKd8wbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_TH19d2hpbGUoYSYmYiE9YSk7Yj0whdUAYZX2dC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAK04AD0ddQApoVsUYT0xO2E8sYBMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBoGash1WXlAGclFiUCBGQ9MgQBHDA8PWQ7LS1kodhIZj1jW2RdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBkFeYEJiYBzAE7BDswQWUlWggmJmQFSAEbCCk7YwWtEHYoYixntegUYy5nP2MuBfoMOmMuaQFAAH215gB2oaEcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQq9-gB3dUkUdCgpLGM9-Qo8Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4IKX19Dg4JFtYIKCAwPD1jP2Euc3ViFmsJHCgwLGMpOmF9CeAMLnJmbC7oBw01aGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtQzVDbkItMHU1RnFGUTZIUHc1SnBHS0xnT2NrUXliT0l3dXUwRHBCYVpXaWx4Q1lwdmVDWUVYcUtsTU1KYUJxR1NYdDdDRjBOOThqZjhNWXhXWURxcWdWRWxMbFEiIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqAZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDFhEMCIgBPClqNggBFvYJUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZQlLAD4NUwA-nSRgIHtyM3B4KCcyNDEwMzA0MzQnKTt9KSgpOz3qEPYTChBIAZ00UE9SVF9QQVJBTVMS4RORI4qUAPB9YWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTE0Ni43MC4xMTcuODgmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9zRYogX3N0YXJ0PTEmoXURu34FDhAmc3ViXw2YAGJBnvB9ci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1Ld2F0QUNQRzdRQWtCdTBBSkVidEFDWkc3UUEtVlUwQVE5b05BRVhielFCeUhJMEFhbHpOQUZZZERRQkVIVTBBU2gxTkFGTGRUUUJkWFUwQWVSMU5BRlVkalFCYm5ZMEFiVjJOQUc3ARAsdlhZMEFjcDJOQUhrARBsQm5jMEFSVjNOQUVYZHpRQkpIYzBBVUYzTkFGRwEQBFIzARAAbAEQAEwBEABUASAEVk4BEABVARAYV1hjMEFWNQEQAGcBEABZARAEV0oBEPRFCUxjMEVCVTNOQkFla2RYQUlhSGx3Q2V2bUlBdEg2aUFJblFxb0NLRUtxQWlsQ3FnSnNWS29DZm1LcUFtQnlxZ0taZXFvQ2dvV3FBZ3lIcWdKR2lhb0NLSXFxQXJXS3FnS0FtNm9DZ1p1cUFvS2JxZ0pEb3FvQ29xaXFBaXlzcWdKaXJxb0NCNi1xQXM3SHFnSXl5cW9DeHN1cUFvYk5xZ0tHMXFvQ2JOaXFBanJacWdMSjJhb0NvTjJxQWxYZXFnSl80cW9DeU9LcUFzYmpxZ0lrNWFvQ29PV3FBajdxcWdKNzY2b0NqLXVxQXFYcnFnTHE4S29DQWZPcUFvM3pxZ0liOUtvQ1dfU3FBcmIwcWdMRTlLb0NEUFdxQW83MXFnTGU5YW9DOVBXcUFsMzJxZ0s3OXFvQ3BfZXFBbFQ0cWdLcC1hb0N4UHFxQWlYN3FnSkItNm9DWV91cUFwZjdxZ0xTLTZvQ0JfeXFBa1g5cWdKSl9hb0NEZjZxQWl2LXFnSlZfcW9DWVA2cUFvTC1xZ0kyXzZvQ2JQLXFBblBfcWdKM182b0NmZi1xQXBYX3FnS1hfNm9DOFAtcUF2cl9xZ0l4QUtzQ2JRQ3JBdUVBcXdLRUFhc0NMQUtyQWpVQ3F3SnJBcXNDZEFLckF1d0Nxd0lvQTZzQ0RBV3JBZ2dHcXdKaHM4VUYwWVlqQ29XaE5SRURyUHNTUGJYN0VpSEYteEpneXZzU2dkcjdFaExnLXhKNTdmc1M4TzM3RXNfdS14S3A3X3NTSlBEN0VxbnoteExzOF9zU0VfVDdFdEwwLXhMLTlmc1NCZmI3RWhmMi14SXk5dnNTVHZiN0VxWDIteElaOV9zU21QZjdFcVAzLXhMYTlfc1NXNV9xRkp6TEhCajZWbXNhV1FDU0tiR1NRVGsmZXhrPTI0MTAzMDQzNCZhd2JpZF9jPUFLQW1mLUFlXzNjNVhyUW1HQWZaVjREUFl6ZDI2V3U4Tkdxcml1ZGJpU0ZVT1BtWmhMLTlKNGdKSGdmRjdLQVU3Ri1kX0dhN0Rwem81U285cmNZU0l1Z2pYcmM3YzN1QzVJeUVsVzBFMTA2d1Q4Y3M5VjJXUEw4LWVGMUk4S2Q0UDBweHdLX3phQzRROFAtbDV2MnVGSkFFNWRaTm16eEVKeHA4QTlSUGp1T1hpZnNFdkFlTDRMYyZhd2JpZF9kPUFLQW1mLUJRbF9CMy1yb0VCaThDY0V1MXRYbkhnVkljdmtlU1ZvdmZsWHJFQmVDNHZuSktWZ2JBLXRLa3pRTjR3S19xV01CSGp2MkVZLTY0d1l4cnZFM3djRWVXSnBJazNmVnY4a0hDZWNUMHBYdE9MSndSYzVjazNycF9zVTNhcHVWY0hVRGlVZVE2bW05V3pjeW5PTTlrWnpsNGowZ0VZTFJzdGNzU1lQMGN2Vi1UdXN0V2RWOWlOUmg2RjFDWjh4ZzA3cHRmNWNIT09vV01KUXF1NkVvU1NRay1Cb0E2TEFfYkhTWVo1VGxrNk1mNWEzM2tteVc4TUk2SkRsSU1HUUtvNlZIUk81cWJobWpiWk8zTUY2ZzBoV3Z3WUhiVzAtWmUyUlVvTmdqOFpRLTdidk9mYjFwQm9IYmtiWmhOOTdDLVJKZ09xYkN1TENDbEY4WFRUMjM3akdESEtDaW15a2k0MXV4T3FFU3JuSWh4Sy1ZZmJ6THpiMVVYX2hEYkFBc1hzUWd3MmVYQlZaRGVGc0JNUU13Wlh4N2J1YkYtcWxGVUVRdEJWZTVwMzRWS1Axb1dmMGpMcjRIOHk0Si04YzFDWmNpZnU1dkRYRHNCSlZlWUdNbnhTeXg5VVc4bjY2WHpMQ01kcUZqOEZIdzYzZ25pUjlUMTIwNGRWYXp5dlRjNFNiMHptRTZabUd6alV3cmRLSGVGZy1pX0pfRVlDc1hSMDhOZW5Ma0RfNFc2ZHN6NzM4cm1zS0s1MDhXY2tEc2lXZHRfUlIwVG5fOG54MUxoY0g0SzhtdjIzU296amFNa1gta0ZRUERrTVpuQ2FYME9aNnpDenplc2U4REp5ZnJKTGpTeFJkaFd1VTMyeGhfZEtfd0NDREwyb25Ub0dlLWh6X3FaOFNLZzVhdnY1aVdKQ1JEdnlEZmZrUC1xaENVb29aaGNGdFBwYlJOZFlMZXA1Ulp2SnVRVi1aclFNenQ5MXdmWTJTQ0xOTWNzX01XdllrQnFRSURtQzBfc01iMUdONy1NZWdMRTNFYmwxZ255WjVDWEc4MUZ0WVNkX25jSl9nbG9yZjBHMmFMZ1pnOE9nM0lUMlR4d3lrY3VoSldIMEtVVTVTb3hYQnFCcFYzZFZ1dVdHdjNCUjNJa0s3MDVZbUhtTjk1ODcyZ0R5bzZ0dEc1NlJ2M3lyaElGWlR0WnFUemtlaW1WSnVHd2NYYjhHbXB1OGYyTzFEam1ncng4eVdRektCX2lSblJ4a3NkdW5vZE80TC1yallibTVuVnlKRzc2eEdOZjNpNmFlckphbzFINXRuOERjak1FVXk0QlF5Tnh6d3dVYkM0NU5EbkVLUV9ESmoyN0V5N3d2anVTZXNvUFh6RDNhd3hCR2JwSzJ1dlA0SWlmLTBqS01McEZOcW16SFFzNC1yMHN3d2xHR0cyU0YzUmJHRGpzeDBsMzhwbVBnZ3hyQ0VaRWx5R3Z2a3psQlVxS0JGeU1NdyZjaWQ9Q0FBU0JPUm8wTUUmYV9jaWQ9gAMAiAMBkAMAmAMXoAMBqgMAwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA0xNDYuNzAuMTE3Ljg4qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdjx2OjQnbORPMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcyQJfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMDYxNTcxOTI3OTa6Bw8IABAAGAAgADAAOLYYQADIB4jbBNIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHuIkMiggCEAA.&s=b0c76638b3ef776925655ed0dd8878b27b736459&bdref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:06 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 95175189-c54a-47c2-930c-a362e814805b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 64D3 0
0 41ms
41ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstnCAfRRf14pwL4vHM7AE9ja65dasEcWKnLcDkMsQeqvGXDVxNV9LWFYQe-vAehjCD-qHaEmT1t56Ew6KL8sAa2YuZUbVWdjZCGmgfW68KZqFXuaIH60GUr1ATNSrIEgHgB2ZN9TMoDz2olN8n2gSlv9qafZQ9nmf3SrY5KtAcrMEZW7JWpfSCkEV3JcVMnAT2v6FCOoRMuT3htFbWg_FP6dF7JAnFVKzn_8aKh5BCGXUXw2wevD2o_N7Y08AzaPiB6kojUgA_HC5euy13HQzX-URdm6QcGs-Qe0L8VanpmX17zWx75np8JXnUKjlaejs-KZjPYga4s6h-znb7--g&sai=AMfl-YSbhAiG1f87KUjMO_lFjmTEc53drQXHyGMIDrkoCAdaH3c9Pn7MxkEXGmj0g4cDT2AVu7QXDHz_CL6oRM-vbuL2lO0t78D2FbdTPf8VOmsVuOMVic-bcrl0r6nHuZx3&sig=Cg0ArKJSzKyTI02EmRJdEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 04:48:06 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
DATA 200
OK truncated
/ Frame 64D3 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 26b9fbe2622f94cb1ad2a48c36afcd1d4773ad6c1b8a05a9d0a7756f2ce70e97

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

/ Show response
track.adform.net/adfscript/ Frame 8698
Redirect Chain

https://ghent-aws-fr.bidswitch.net/imp/0.026286999999999998/BSWhttps_A_B_Btrack.adform.net_Badfscript_B_Cbn_R38689783_Qrtbwp_R_I_WAUCTION__PRICE_X-pFDX-N6A6rpWjTDRq9J__6__n5Utn6OYcN0_Qrtbdata_RFggD...
https://track.adform.net/adfscript/?bn=38689783;rtbwp=0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0;rtbdata=FggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDN...

978 B
1 KB

17ms
17ms

Script
text/javascript

37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=38689783;rtbwp=0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0;rtbdata=FggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1;OOBClickTrack=$%7BCLICK_URL_ENC%7D

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

00eda9d5c68f4c28b7fda7c9a92e296562579a12310d8eb56e6b01129715630e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 842
expires: -1

Redirect headers

Location: https://track.adform.net/adfscript/?bn=38689783;rtbwp=0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0;rtbdata=FggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1;OOBClickTrack=$%7BCLICK_URL_ENC%7D
Date: Wed, 20 Apr 2022 04:48:06 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H2 200 / Show response
onetag-sys.com/analytics/ Frame 1317 0
180 B 7ms
7ms XHR
text/plain 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/analytics/

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/static/BannerAdBannerPlacement.js?v=0.3.13

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://wheregoes.com
strict-transport-security: max-age=15552000
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Origin, Referer, User-Agent, x-ak-clientip
content-length: 0

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 64D3 0
834 B 17ms
17ms Ping
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&e=wqT_3QKJBugJAwAAAwDWAAUBCIWh_pIGEN-Bqu2jtN78RhgAKjYJ7QvohTsXrj8RJKO5BJYSqD8ZAAAAANej4D8hJA0SACkRJMgxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreIjbBIABAYoBA1VTRJIFBvSFApgB2AWgAVqoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgAp_wP-oCKGh0dHBzOi8vd2hlcmVnb2VzLmNvbS90cmFjZS8yMDIyMjExODIzMy-AAwCIAwGQAwCYAxegAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUM2dmRVNWEyR2MzS3JubnhNV2JkUHpuY2tMeHg5Zmx1RkM3WktqT05tOXBCbWIxY3NEX19WajJfeHhobXFoRkJDYUpVSEszckJPNXdvRm9SV1lONm9QQ1FxcDhRJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzUxMTQyNTI1ODk1ODIxNTU5OTkiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA0xNDYuNzAuMTE3Ljg4qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdjx2OjQnbORPMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcyQJfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMDYxNTcxOTI3OTa6Bw8IABAAGAAgADAAOLYYQADIB4jbBNIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHuIkMiggCEAA.&s=88f7af388cf39bef689bf9f6f037ed3087643d3e&type=nv&nvt=5&jm=1003&px=436&py=474&bw=728&bh=90&sid=1034336911527911260&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&sw=1600&sh=1200&pw=1600&ph=2226&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:06 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5eaf3285-b8df-4549-842c-e2c221797f8a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 3A82 100 KB
33 KB 79ms
78ms XHR
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83648c59a5d3107bbafbb3c5f370f666c920baa3302dbb2405b58c9ea6fe42e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34274
x-xss-protection: 0

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 2AC3 80 KB
31 KB 69ms
69ms XHR
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b60a9e27970242742ed834cfa71489bfb6955dde65d75cb81495947f9337d876

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31587
x-xss-protection: 0

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 52B9 0
834 B 15ms
15ms Ping
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&e=wqT_3QKLBugLAwAAAwDWAAUBCIWh_pIGELmnwpPrsbf2FxgAKjYJwQKYMnBAmz8RNALgjibNlT8ZAAAAANej4D8hNA0SBCnBDSTIMQAAAOBRuJ4_MPXtsws4ykFA5R5IZVChn-kkWJjVUmAAaM_4a3iI2wSAAQGKAQNVU0SSBQbwqpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjIxMTgyMzMvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYQEG9AUBX2I9QUtBbWYtRHBWVTYwRUlIUXJCZDdIZmdhZVVHN0Y4Wk9CWHJnbjRuTlQybjgzN20xNE16VG90dlBWcHFNak1La0xYczRDUW93d3lJc3J4WGVlZFFYS0Y1ZktSX214cGlQb0EmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTcyMzk5NjM2MjMyNDg3NDE2OSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDTE0Ni43MC4xMTcuODioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBCHWVIgFAZgFAKAFvaCM6Mb0vMJAwAUAyQVBIRwAAPA_0gUJCQkMeAAA2AUB4AUB8AWapkD6BQQIABAAkAYAmAYAuAYAwQYJJSzwP9AG7o8B2gYWChAJEhkBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMzkwNTM3MDUyOboHDwFYSBgAIAAwADi2GEAAyAeI2wTSBw0VhgFHCNoHBgknROAHAOoHAggA8Ae4iQyKCAIQAA..&s=04bfe93f98b3e02506caeffa419ecee6deaeeac4&type=nv&nvt=5&jm=1003&px=1091&py=666&bw=300&bh=250&sid=1034336911527911260&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&sw=1600&sh=1200&pw=1600&ph=2226&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:06 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8d2a34f8-dd52-46ac-a693-e54dc7a7d973
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame D3D8 33 KB
16 KB 128ms
20ms Script
text/javascript 37.157.5.72
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=48267046;rtbwp=0.237705;rtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Thu, 21 Apr 2022 08:10:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame AE01 0
9 B 6ms
6ms Image
text/plain 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?YwJd_Q
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame 8698 33 KB
16 KB 96ms
41ms Script
text/javascript 37.157.5.72
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: ghent-aws-fr.bidswitch.net
URL: https://ghent-aws-fr.bidswitch.net/imp/0.026286999999999998/BSWhttps_A_B_Btrack.adform.net_Badfscript_B_Cbn_R38689783_Qrtbwp_R_I_WAUCTION__PRICE_X-pFDX-N6A6rpWjTDRq9J__6__n5Utn6OYcN0_Qrtbdata_RFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3__gbA9__NotpUPY8BrnNn__FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T__7M1jQDyzFSDL__BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1_QOOBClickTrack_R_I_WCLICK__URL_AURLENCODE_X/dUeo9yERFVXTfJA6vVZmEdDt7VblSzRoU0jRHncAmxaK0YJiO9wd5bs1UDCU5wSwm3stIQsAhXb86RCasTNqDjg_zYC2vEJmwsKhpnucV8-V7T6upRajxVO9SQXg0MFHdGcQwyq1Ab70HYww2YoDAELVbahSZ364AIDxsBZvolTWPJrUpAE8nZBcKhZebr4of4ZQW7tBbIfE5ucbBMHX9RPejYcfBdURGb7U0KZ1NGnCNlXxPy_pKs6a6yrlTQExMKJKhYvt0DLGzaotP3tkmLOOobhGA0-UfOhbrbmnRb_TckBvKctthddg03nB518JNxLdHhwvO_PTJ1WtOit8MgiHK1McnH0gh_ARi7WlbTVNmYsMizL62ougZCttQc2BoPJjbqi9503_2UznHI8rdMB5SoQGs2ZwcLa_UBWr3HaMNvFhPGFcufuiQgBMDPvsmNz8Z0y-GdzDelxjlc8wD-6LVlc2PnzuWi7TktFCpO22DA3drmSWJhEbi2WRIfvD2Fcu7Xmz-U-uYf2OZGIs1eLRlFt2s8fD8uJFd11hvkLRIpCgqW68mHfzFAsWXhpOeGPjATOI7QO7OG7qOpKZ4C2vtOJDBaqTuY37IL6EiUtVKHridbWx2V39JnuDI1ebOfKy4sPtypBHX4LM34cS993wqUCJthoiWL_4_AjcjTJ8LWic56LLpBnAjt9ZjsYUofGhhx11DzWR9qjlDtSXUOoEQbYw9eyux0QEUY64wACVVZ9-fXEkdJitepSpAWFmuWJHY6hy2W6W2TouofkDvPHg-3qe4obaCDtKpFSMR1_REuKUXzNx9tDV2I0n3xOZr5A/$%7BCLICK_URL_ENC%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Thu, 21 Apr 2022 08:10:00 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/ Frame 2AC3 25 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 02:04:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9842
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9777
x-xss-protection: 0
server: cafe
etag: 12512753850102923420
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 02:04:04 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 2AC3 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b59e198c356c79d1ba89670c50cdb7e54181037f277ee106126caf570278bc11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 01:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13375
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
server: cafe
etag: 15450667304708860052
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 01:05:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2AC3 119 KB
36 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caa2b4b885d62d25d986de63c6e3163f9c7da374d9b76bc4a412b61d4f2975d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650281421154365"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 2AC3 19 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

068e2ad9020fdc590c232b49e3ebbb8b540719796165ad86ab75bb6a7f54bf20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 02:10:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9444
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7667
x-xss-protection: 0
server: cafe
etag: 7504708142712926003
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 02:10:42 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2AC3 0
0 31ms
14ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQn5JdWCGadWs6uIdkcAIQcgVij02H65oBVnPWEvher-zjQV039a3B-p0-FC53uVOhP0TPdttGWlyHP-oWa740bWqaK6g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 2AC3 39 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/one_click_handler_one_afma.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6c25e591394ea7aa5b84b25e9e6b44e38773a3289a2db50987b2cf946c100ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 06:28:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80368
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14839
x-xss-protection: 0
server: cafe
etag: 8993619844746972551
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 May 2022 06:28:38 GMT

GET
H3 200 1260202662415105307
tpc.googlesyndication.com/simgad/ Frame 2AC3 31 KB
31 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1260202662415105307?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qnwNdPoUxckBGo9J62UURxIMYDTmQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4176001d49617605a8beb6c6a0d715851796618e1637f6d5865fd4af0259f7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 07:57:03 GMT
x-content-type-options: nosniff
age: 161463
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32181
x-xss-protection: 0
last-modified: Mon, 18 Apr 2022 07:31:19 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 18 Apr 2023 07:57:03 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 2AC3 0
17 B 48ms
47ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CfOCPhZBfYrO5L8Gg7_UPkoyYuAaEpJnTacCT7PPAD7_hHhABIOaX1iVgleKQgqAHoAGDwK6VAsgBAqgDAcgDyQSqBOABT9AHEefgLInNgj0u1_OyTPhbxb0cFFZdzds7P8PUICyKaaZUOnqN9fBSSVncKQZiUSGrpiRZbQkwpfpdC_Ke-qg5dyUvIRgWKS2OxXLRgQfEgJlS7AUb2iJnXRoUx1eDKL8t3goqvqaHto1CBi0K-CRaJKWJZTe60jcLGT4BFKu3aDMmpizQnzov3AJwzPtu42B2lm5327jMPE-TgUsuf-PaaM2P7vtgZjaOXcqWAo6LPIobfO1--37DM6_10XK4zO3A7iRAkhFCAKYDV7NfT814h1pHMQJngp1nolwOwqfABKGbh-vyA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBoAYCgAflv9HqAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB0ggJCIDhgBAQARgA8ggOYmlkZGVyLTMwNTY0NDeACgTICwHYEwzQFQGYFgGAFwGyFwgKBggAEgAYAA&sigh=cNGsykAfbl4&uach_m=[UACH]&pr=10:0.026613&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 20 Apr 2022 04:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 3A82 8 KB
1 KB 35ms
15ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e046a89bb90f44dadb24f5fdfbe412b5f6d320b790f7317fad956b193234726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 20 Apr 2022 02:51:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 20 Apr 2022 04:48:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 3A82 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f4362568e9be366759f9ada329e928f398f49333040bc12fcf2de18483d1f52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 23:00:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20827
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1201
x-xss-protection: 0
server: cafe
etag: 17441257144546641969
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 03 May 2022 23:00:59 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/ Frame 3A82 25 KB
10 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 02:04:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9842
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9777
x-xss-protection: 0
server: cafe
etag: 12512753850102923420
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 02:04:04 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 3A82 3 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b59e198c356c79d1ba89670c50cdb7e54181037f277ee106126caf570278bc11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 01:05:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13375
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
server: cafe
etag: 15450667304708860052
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 01:05:11 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3A82 119 KB
36 KB 19ms
17ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caa2b4b885d62d25d986de63c6e3163f9c7da374d9b76bc4a412b61d4f2975d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650281421154365"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 3A82 19 KB
8 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

068e2ad9020fdc590c232b49e3ebbb8b540719796165ad86ab75bb6a7f54bf20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 02:10:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9444
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7667
x-xss-protection: 0
server: cafe
etag: 7504708142712926003
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 02:10:42 GMT

GET
H2 200 617b63f321f8765d5e5b029f2733e5f4.js Show response
www.gstatic.com/mysidia/ Frame 3A82 39 KB
15 KB 29ms
7ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/617b63f321f8765d5e5b029f2733e5f4.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b50a75198d34e4ad82efa4840a3c3c0d319203db9c65295a9a763ebfd0e999dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 14 Apr 2022 13:44:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 486220
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15048
x-xss-protection: 0
last-modified: Thu, 14 Apr 2022 13:32:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 13 Jul 2022 13:44:26 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3A82 0
17 B 50ms
50ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CrFJihZBfYse0L4bRgQemmq3gBr7m2ZFo78SHi-8OnbL0j4cdEAEg5pfWJWCV4pCCoAegAfD27pEDyAEBqQJzwlWk8BmyPqgDAcgDywSqBO8BT9CRZOGFd6Kww47kXvdQYN_xtB5knJb10IWva_46eKf1g-1hBUbewM4hFB144eRyzbyFyDUEZDfFGC58HMcD5N7kTxXXxPjAgXtcY7jJ3UIzfrkpb-gv03VpoFoAYvfNHlwq_70ISs2acU9bYs5x4GgNrtuKFIW3cO1cLUYTtDRp97_dt3Ypz8MQTl4m65KBzQHwI0oxKhL4rXx19s1uQDXwF39BRhXKRrYCBafhWZymv-nNzWXfFXq4ZyZwRmNj9ZzbWjy7O9NnhWCOfqLVSFNoTuFYfnQdXsiP_3EE6NpHoQo15VVFNmBvT6ETB7jABNzs2LuLA5IFBAgEGAGSBQQIBRgEkgUECAUYGJIFBQgFGKgBgAf4iJFuqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHSCAkIgOGAEBABGADyCA5iaWRkZXItMzA1NjQ0N4AKBMgLAdgTDIgUD9AVAYAXAbIXCAoGCAASABgA&sigh=bBG2VudFe5w&uach_m=[UACH]&pr=10:0.058771&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 20 Apr 2022 04:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6152 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2391
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Wed, 20 Apr 2022 04:08:15 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F66A 143 B
163 B 7ms
6ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2391
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Wed, 20 Apr 2022 04:08:15 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2AC3 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7a880f6dfa267878dfd953d9fc75626536df9e606fc59d59cee130164bf3047b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3A82 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 283ac62b5fa49a130222372249026528add71321557ee5b5ab2de6e8acf5d9a3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v42/ Frame 3A82 28 KB
28 KB 30ms
7ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v42/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a67d07f733785876b3192826e76f537e2b9dc0be172ce52c773d30d65f712a07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 22:46:42 GMT
x-content-type-options: nosniff
age: 21684
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28328
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 21:57:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 19 Apr 2023 22:46:42 GMT

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame D3D8 5 KB
3 KB 17ms
17ms Script
text/javascript 37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?bn=48267046;rtbwp=0.237705;rtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;js=1;adfxid=1x;9574;set=en-US|en-US|1600X1200|0|300|600|24|8|3|7|0|0;fd=0|2&CREFURL=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

7291aeee2b70dfed6dc69dbab579ea33e37c22f14d99975a65b53bb13f371e97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 2283
expires: -1

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame 8698 5 KB
3 KB 17ms
17ms Script
text/javascript 37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?bn=38689783;rtbwp=0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0;rtbdata=FggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1;oobclicktrack=%24%257BCLICK_URL_ENC%257D;js=1;adfxid=2x;9997;set=en-US|en-US|1600X1200|0|750|100|24|8|3|7|0|0;fd=0|2&CREFURL=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d609f9345c194caf9a15834cc0bac20feb91c94576ba12ea404babc56da44bf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 2385
expires: -1

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6152
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

32ms
31ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 20 Apr 2022 04:48:06 GMT
expires: Wed, 20 Apr 2022 04:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 20 Apr 2022 04:48:06 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame F66A
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

74ms
73ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 20 Apr 2022 04:48:06 GMT
expires: Wed, 20 Apr 2022 04:48:06 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 20 Apr 2022 04:48:06 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 l2o4cWLNalU19nN7vA12WZhb1qS4KDqIWPmZT-glBuk.js Show response
pagead2.googlesyndication.com/bg/ Frame 23AB 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/l2o4cWLNalU19nN7vA12WZhb1qS4KDqIWPmZT-glBuk.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

976a387162cd6a5535f6737bbc0d7659985bd6a4b8283a8858f9994fe82506e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 21:22:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13574
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 21:22:49 GMT

POST
H2 200 /
track.adform.net/csimpr/ Frame D3D8 35 B
467 B 17ms
16ms Ping
image/gif 37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=48267046&csi=xfUDNzSSq9e1Vr3tpeFAxv14e-DE9tfV5d2WdCoesRXZKGWOLEEutt6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 / Show response
trendads.reactivebetting.com/sportwetten-de/ Frame 4FB4 20 KB
8 KB 120ms
51ms Document
text/html 2600:9000:2156:9400:6:834a:a040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9400:6:834a:a040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 71aacea2999743ff59a8aa7c66b56672638e082a6c223b9520212e38249f7bc4

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Wed, 20 Apr 2022 04:48:07 GMT
etag: W/"5b8a639cbf4237b266f9d82405b0e20c"
last-modified: Fri, 08 Apr 2022 09:02:49 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
x-amz-cf-id: IINdaVqtlTExUFs_yq5g-1ls5lkUXaDQTv-vbHVcvlXKe1o-z3UxFA==
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront

GET
H2 200 r62eglto.js Show response
ad4m.at/ Frame 8698 35 KB
13 KB 86ms
38ms Script
application/javascript 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/r62eglto.js
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfcdd352bb06fcc5c0e6f3f9b96e0c9a7d42f99b94473534d5131dcb4a104ec9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=RQuziQ==, md5=aEKpUkwBcgJ5WaD3yT+HcA==
date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 60990
x-guploader-uploadid: ADPycdsjbbGwoClAviClI_b-RVGsj419bRsgc2aQTBcPeuotIInjk03xCTJ5ZFya9lTCf2IXRkywzizAjOFu7NjVd8qPMQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 05 Apr 2022 11:51:07 GMT
server: cloudflare
etag: W/"6842a9524c0172027959a0f7c93f8770"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FfHcpnuOq1Osmtz0RqOqKeaCPQHXFr095NOrRjMVuzbfh6PitGHLiFZe9Lx4c1ki3ryxpskJnSQFCaPihijT8eSg77djb3oUdwurU2zkzZ5QDX7l9Y%2FcJSW8uj7m7%2F0ScQw%2BvWs%3D"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1649159467260020
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600, must-revalidate, stale-while-revalidate=300
x-goog-stored-content-length: 11886
cf-ray: 6feb3eeaccaf3752-MXP
expires: Tue, 19 Apr 2022 11:51:36 GMT

POST
H2 200 /
track.adform.net/csimpr/ Frame 8698 35 B
467 B 18ms
16ms Ping
image/gif 37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=38689783&csi=xfUDNzSSq9e8rJZurfDtVyknKe-DwQrM6BhdnxC612XZKGWOLEEutt6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:06 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 ThirdParty Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/.gSBgiDQ/i/vCAv.IAAAAAoAA/r:types/ Frame D3D8 35 KB
15 KB 20ms
20ms Script
text/javascript 37.157.5.72
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/.gSBgiDQ/i/vCAv.IAAAAAoAA/r:types/ThirdParty
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: d80c5e589d01a4960b7737680fe9bd09293cab9db77fcfb7de2d64a1f0361037

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Thu, 21 Apr 2022 08:19:11 GMT

GET
H2 200 ThirdParty Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/.gSBgiDA/i/vCAv.IAAAAAoAA/r:types/ Frame 8698 35 KB
15 KB 21ms
21ms Script
text/javascript 37.157.5.72
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/.gSBgiDA/i/vCAv.IAAAAAoAA/r:types/ThirdParty
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.5.72 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: d80c5e589d01a4960b7737680fe9bd09293cab9db77fcfb7de2d64a1f0361037

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:06 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Thu, 21 Apr 2022 07:58:11 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/ping/lXwKCPe1ERED7wbFvmmp3C60tbfHxwES-4YrtZkbTrf01KATJWUQoB-Ramra8htk485zM_our9YIRsNJODsedyPQAZauKNX4b6UKzI69fwPbS_kmz01FWxRQok_y9gAew7L2uZGZhtaCGZGMC8fZBFlMBuzb4zoI--ASqCsN30L2w8Ufy8JOSRLoYbXKXQhmaIqbzq-Tkdde4cHMUul1Rw;M877-58yCQPJYq9qTFB9afYs0EdEOpCgptWCJmA4IDA:jiit0vVpqBPmMGlyjXPTNXoLWet8Sj6SyzxLJ-FQwqi2jwcAitc9rViv11M_biSqbuKwaZdGooVsLbp-xTTgds_u2dCFl5lABrusn7mrxqklkLhft72Aio1gUs2zRTHJkW1NezFrhmlhBcd53ZQqnqx-YSdg2AuGgk_8TwuLE0L704SxatKJUjaEyKM7sCFB9UCekRv6EbD8VSr4ZIRHAmJd6Kcx9OIK7hQezKviRaG3H_bjW5jm6k_exPO-IqfA5WC6kg3KCnwmi3oqj0D-2fKgRKLgFK-8f_HS-Yr7YWxOqmdzX7-hQfaWnd-_JajOoUcqFB72RkU5oC6Z3suIjTJY5j-IdWErKimdteBYEPO-d5N-JQ2MvHYFv0J2PdOHKtbZJFfuRXxZugLWht7bptQWTljcwKxNQogwXbw4jkKvgOaFdits6sJGGiuMLHiFbfjgVzrFUIU1tXzWNZmO_0mVfnYTToS9dxSZlDCxBV0ktmUT1YG8R7s6Xidsep8rg6u8nsvY_NS3XcE20a7-eyX6jVarOQyYv1TsuYOJtDwUNKIgzsjqiSKU5O-da6azwQLawnYUs2iK05-W41RXmnwjCE1InCe2_eWzqT8YUIowss2HoV2-fEskCdyCCy2h03oopY3L2fRMo1bdrX7__opQKpuskWPiQSCp99gZ_GM:1:0:0:0:0:0:0:0:c81e4b7d-58dd-47db-8918-20d283932058

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/ping/lXwKCPe1ERED7wbFvmmp3C60tbfHxwES-4YrtZkbTrf01KATJWUQoB-Ramra8htk485zM_our9YIRsNJODsedyPQAZauKNX4b6UKzI69fwPbS_kmz01FWxRQok_y9gAew7L2uZGZhtaCGZGMC8fZBFlMBuzb4zoI--ASqCsN30L2w8Ufy8JOSRLoYbXKXQhmaIqbzq-Tkdde4cHMUul1Rw;M877-58yCQPJYq9qTFB9afYs0EdEOpCgptWCJmA4IDA:jiit0vVpqBPmMGlyjXPTNXoLWet8Sj6SyzxLJ-FQwqi2jwcAitc9rViv11M_biSqbuKwaZdGooVsLbp-xTTgds_u2dCFl5lABrusn7mrxqklkLhft72Aio1gUs2zRTHJkW1NezFrhmlhBcd53ZQqnqx-YSdg2AuGgk_8TwuLE0L704SxatKJUjaEyKM7sCFB9UCekRv6EbD8VSr4ZIRHAmJd6Kcx9OIK7hQezKviRaG3H_bjW5jm6k_exPO-IqfA5WC6kg3KCnwmi3oqj0D-2fKgRKLgFK-8f_HS-Yr7YWxOqmdzX7-hQfaWnd-_JajOoUcqFB72RkU5oC6Z3suIjTJY5j-IdWErKimdteBYEPO-d5N-JQ2MvHYFv0J2PdOHKtbZJFfuRXxZugLWht7bptQWTljcwKxNQogwXbw4jkKvgOaFdits6sJGGiuMLHiFbfjgVzrFUIU1tXzWNZmO_0mVfnYTToS9dxSZlDCxBV0ktmUT1YG8R7s6Xidsep8rg6u8nsvY_NS3XcE20a7-eyX6jVarOQyYv1TsuYOJtDwUNKIgzsjqiSKU5O-da6azwQLawnYUs2iK05-W41RXmnwjCE1InCe2_eWzqT8YUIowss2HoV2-fEskCdyCCy2h03oopY3L2fRMo1bdrX7__opQKpuskWPiQSCp99gZ_GM:287:0:0:0:0:0:0:0:c81e4b7d-58dd-47db-8918-20d283932058

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

GET
H3 200 frame.html Show response
ad4m.at/ Frame 3866 2 KB
2 KB 69ms
39ms Document
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/frame.html
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d12a71cd626ac8f0fc91e6f1b98280cfb49fd724f2dcc118d192adff9a0154b4

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1219297
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=3600
cf-cache-status: HIT
cf-ray: 6feb3eeb596183a2-MXP
content-encoding: br
content-language: en
content-type: text/html; charset=utf-8
date: Wed, 20 Apr 2022 04:48:06 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Wed, 20 Apr 2022 05:48:06 GMT
last-modified: Wed, 06 May 2020 15:09:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vi0eXOgF4gvsHDriq%2FQcGR8U5S5rHdGfT0qTUL2nhx9OevSxC7PeozARm4kHrMrY1MjLVu95v0wCkVKypUfYxXnZ%2FdA2r83o3O8Gt5UQAlws3c6LniEw3IQ%2FKMbqMFCgej2HgDk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-goog-custom-time: 1970-01-01T00:00:00Z
x-goog-generation: 1588777770164783
x-goog-hash: crc32c=iTDHew== md5=c2ZaqCqAXxKd4MgeeQDU8g==
x-goog-meta-
x-goog-metageneration: 3
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1681
x-guploader-uploadid: ADPycdunJgVlrvJk1i4V6EeqzatPhaSnLm6oIWOTelRdPaqnkcFkkR_BCVkP3mYoCL4WPcEUy1UhJuTUv7ryZUo5tpCgVZe-wQ

GET
H3 200 css
fonts.googleapis.com/ Frame 4FB4 12 KB
947 B 31ms
16ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700|Roboto+Slab:400,700|Roboto:400,700

Requested by

Host: trendads.reactivebetting.com
URL: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3a015453ff4a06def8f858ef06306e9c066c2454836a4919240719eb052575dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trendads.reactivebetting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 20 Apr 2022 04:48:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 20 Apr 2022 04:48:06 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 20 Apr 2022 04:48:06 GMT

GET
H2 200 main.ca9182b0.chunk.css
trendads.reactivebetting.com/sportwetten-de/static/css/ Frame 4FB4 6 KB
2 KB 7ms
7ms Stylesheet
text/css 2600:9000:2156:9400:6:834a:a040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trendads.reactivebetting.com/sportwetten-de/static/css/main.ca9182b0.chunk.css
Requested by: Host: trendads.reactivebetting.com
URL: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9400:6:834a:a040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 838d62ecfee5112a90fa736246a6b34bc008eb37df0443e118472210bd278f10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 03:33:11 GMT
content-encoding: gzip
last-modified: Fri, 08 Apr 2022 09:02:52 GMT
server: AmazonS3
age: 4496
etag: W/"ce725a2c4bb20be47a8e03d3545e0185"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
via: 1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: qX1iQicc1HFhoCT7qDXv5YI3gk696vYqRAbcg7eDNL4l2EYWfkik8g==

GET
H2 200 22.b8a45b14.chunk.js Show response
trendads.reactivebetting.com/sportwetten-de/static/js/ Frame 4FB4 142 KB
44 KB 8ms
8ms Script
text/javascript 2600:9000:2156:9400:6:834a:a040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trendads.reactivebetting.com/sportwetten-de/static/js/22.b8a45b14.chunk.js
Requested by: Host: trendads.reactivebetting.com
URL: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9400:6:834a:a040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1b9645c54e08df22c35c4e80ccc4a72cf8cb182ef5cfddaab3f08b0411463ae4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 03:46:28 GMT
content-encoding: gzip
last-modified: Fri, 08 Apr 2022 09:03:48 GMT
server: AmazonS3
age: 3699
etag: W/"aed4321944dca8368cd302793023c3ff"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: CPG2wcmFz4BefQQQT8-pAav4JoUP4FYXxymcaRRgzoV4sYK_eSJerw==

GET
H2 200 main.efacf028.chunk.js Show response
trendads.reactivebetting.com/sportwetten-de/static/js/ Frame 4FB4 118 KB
32 KB 14ms
14ms Script
text/javascript 2600:9000:2156:9400:6:834a:a040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trendads.reactivebetting.com/sportwetten-de/static/js/main.efacf028.chunk.js
Requested by: Host: trendads.reactivebetting.com
URL: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:9400:6:834a:a040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dcbaa0d69a9a39756a0bf5f50c8087e87ceab3d4164b3d86cbec4ea21a6c4955

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trendads.reactivebetting.com/sportwetten-de/?matchCount=6&autoFill=true&sport=Football&language=de&template=MatchBanner&size=300x600adServerClickPrefix=https://track.adform.net/C/?bn=48267046;crtbwp=0.237705;crtbdata=JgKckWrbBA-Vak6j9cCWRGClM8-nCfTGd_knFH5ifZIndPbeN3lQBWhV2vtghEdVuvjTukgASOzsUpqzamMIECvmx10YdaN1LqmunN5TkBYE8-4jS3A0rUTVNxElYHP2can_24AtvDgLVoonOWelX4Alt_XGjxaCOmw56_VKbiwFafkAFCQtmH5YVwismtJNeyj2GnxKx9KHGM5farb1jvKppmE8W3zySLi72c4Y0cTD6kDsH5wiehtv4kc6kuKtvvk7P4m62a81;adfibeg=0;cdata=uwePL8LzkQpHUHzVSEv3vTHonrRX09eX9JNXQxCmCsO1Vr3tpeFAxlVkYxOPmTqpTC4hD4-EoHNCOhj0lw8jQkArBVVsR5ERxOP7EGRkIKg1;;CREFURL=https%3a%2f%2fwheregoes.com%2ftrace%2f20222118233%2f;C=1;cpdir=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 06:48:01 GMT
content-encoding: gzip
last-modified: Fri, 08 Apr 2022 09:03:27 GMT
server: AmazonS3
age: 79206
etag: W/"57ad240952e01251f429fec63c3e59e0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 bab8148a65b29113f79cf2725076287c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: dHhpfqR8qQslkY9hdbTA77hLG8AYOHl8be7XYSCS9XI93E9SQpVQoA==

GET
H3 200 l2o4cWLNalU19nN7vA12WZhb1qS4KDqIWPmZT-glBuk.js Show response
pagead2.googlesyndication.com/bg/ Frame 62CE 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/l2o4cWLNalU19nN7vA12WZhb1qS4KDqIWPmZT-glBuk.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222118233/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

976a387162cd6a5535f6737bbc0d7659985bd6a4b8283a8858f9994fe82506e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 21:22:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26717
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13574
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 21:22:49 GMT

GET
H2 200 de.json Show response
trendads.betfindr.com/i18n/sportwetten-de/ Frame 4FB4 15 KB
5 KB 41ms
7ms Fetch
application/json 2600:9000:2156:b200:6:834a:a040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trendads.betfindr.com/i18n/sportwetten-de/de.json
Requested by: Host: trendads.reactivebetting.com
URL: https://trendads.reactivebetting.com/sportwetten-de/static/js/main.efacf028.chunk.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:b200:6:834a:a040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a759c9120394fec99cf2cc8c3e591520e688ff6aca64e352859bb7fb9e728aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trendads.reactivebetting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 02:34:26 GMT
content-encoding: gzip
last-modified: Thu, 23 Sep 2021 08:27:17 GMT
server: AmazonS3
age: 8022
etag: W/"d38341505f42d14b8702b20d427f7f46"
vary: Origin
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: zP1ySmHN4vNfwLuZBojWEBq-SciggXdipc8GtwWhvoloWt61oDPBkw==
via: 1.1 32c8da10203574baccb74b8f771a7ffa.cloudfront.net (CloudFront)

POST
H2 200 view
trendads-swarm-api.reactivebetting.com/.crm/banner/ Frame 4FB4 0
0 68ms
68ms Fetch 2606:4700:20::681a:914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trendads-swarm-api.reactivebetting.com/.crm/banner/view
Requested by: Host: trendads.reactivebetting.com
URL: https://trendads.reactivebetting.com/sportwetten-de/static/js/main.efacf028.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:20::681a:914 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://trendads.reactivebetting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json; charset=utf-8

Response headers

date: Wed, 20 Apr 2022 04:48:07 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MvIRf1eZkznLFd5wLTyd38GQNvQ%2Bf0psve451f7Z8xfbmbZVzbBfca%2Bfg9vqQatM4t0dY3i7DEBckoUty5W05aMqPIPgWDVGvMf%2B1l%2F9I2%2F49T6bZWUTkkqoDdsvvr4APz1gnFdpGhC6wgqLvY7%2BYGhzRCftjZEi0OAjlB0CZaAEHGFY"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: https://trendads.reactivebetting.com
cache-control: no-store
access-control-allow-credentials: true
trace-id: f29ee49a26457400
cf-ray: 6feb3eecc9e2839c-MXP
content-length: 0

OPTIONS
H2 200 view
trendads-swarm-api.reactivebetting.com/.crm/banner/ Frame 0
0 157ms
109ms Preflight 2606:4700:20::681a:914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trendads-swarm-api.reactivebetting.com/.crm/banner/view
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700:20::681a:914 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://trendads.reactivebetting.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://trendads.reactivebetting.com
access-control-max-age: 3600
cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 6feb3eec18e3839c-MXP
content-length: 0
date: Wed, 20 Apr 2022 04:48:07 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5RaTmjN9Ba1Qo5zUXFemJ7e%2F%2B73lgavFCwBf%2Fd9BRmUz9HpyfIcwLs3kQ%2BH7HwYbyprHSgWqbcHp0Hf%2BcYVT5e%2F%2F%2Fl9imdD5dXu4pMfNpgRwxabrnEvHAI5HUDaYP%2B0uUjzjk2%2BbIJM31LhCZ5rwv16H31zkyAzPHlZgfANOZMeBXnUw"}],"group":"cf-nel","max_age":604800}
server: cloudflare
trace-id: 83cc81674f71c8b6
vary: Origin

POST
H3 200 rs Show response
ad4m.at/ Frame 8698 1 KB
1 KB 55ms
54ms XHR
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Requested by: Host: ad4m.at
URL: https://ad4m.at/r62eglto.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: faf513ab7065379b4f33f7b90d55cc49586616574897bd548eb6cf148e5f9c26

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

cf-ray: 6feb3eec4c750e12-MXP
date: Wed, 20 Apr 2022 04:48:07 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3g3SW4FkrtIOn%2BjifbhYFWIpkc8JgxtbsPpcKSMN42RqWJ5FRQkPilbG7IBiU5D70lGdFC%2BIIvn9GH69UpanKeT4Xh7559MdETA5adqGea7WNouRCb2%2Bd%2FjP8p%2FAUpBuv7ZLZ4c%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain
access-control-allow-origin: https://wheregoes.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
access-control-allow-credentials: true
content-encoding: br
x-backend-server: aa-reachservice-group-europe-west1-4w5m

OPTIONS
H3 200 rs
ad4m.at/ Frame 0
0 67ms
46ms Preflight
text/plain 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4m.at/rs
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://wheregoes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET,PATCH,POST,OPTIONS,DELETE
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 1800
allow: HEAD,POST,GET,OPTIONS
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 6feb3eebfc300e12-MXP
content-length: 24
content-type: text/plain
date: Wed, 20 Apr 2022 04:48:07 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c7IaO98fUa87w51YCJoSk2isapNJCWHlpjK7vmG3351CYSKgg%2FanvIdiTbe1cK6n0iDdQFKz7iqnNcxVN7gtvgx5hGPhRnZNjlZDnuc%2BESSaSv6FPsKoeQ4KQeCDfRxNe6Md8JY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
via: 1.1 google
x-backend-server: aa-reachservice-group-europe-west1-4w5m

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 64ms
63ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022041301&jk=4302344040976430&bg=!r6ylrOjNAAZvJBiFTyQ7ACkAdvg8WuTHYRDxNhnhYnLRE82aZxCziQpJPB3hNFYZ8IQXSYW_QSWVNQIAAAEFUgAAAAJoAQcKAGrbCVCykO71G12qhp-0_rEnQzA-KE_VFnTC3x_6UQg_S6VrqDIhvz4t539GL0Rkl9xiETe_OFqvmQQyOLxc8M5SWfdmAPKL16y4I5ZMppGkbL1CotaukpfsTaids1BNvXutVMIg4G7YwrNcmQKVe1W9gI5bu3zvdGV1z_PkLbfgBbewDOdUB-Y44WSwG4FTZ6c6cGP6yVN7Dj4ngbwwZt67zuuR6Hh9R2bJEE1ZS_cQm90qkYFaB1rJKVkA1ah4rbmgir4JDpz4MJkiw3G-4MC6sZoPhLQLLybJVK15uy1_FYMl4CW-cTGFT6iOlN6nzNtQ3pxqtHRtratSrZ3RVB7uk0SwFdhmi5WyD9-9_Qoidl41z6Iyer5_xPAPcdToCeR4paVym_3w5NtzduiDCRso0lDXx9PjPHYFIv0H7yfayw6mmvl1N1k7xknTDG0kQsMFJAh3JAk7J_zHq3YhZ8FaErdSNiSgKfAV_2n_UdZ0HjVYQmxbSLZBY0bs3HZ8dlz3Jc-W0E5vRcBSsuByQhBifRIW8ppjY9wcdfXgE01lKeC8Y5j8ZSEe2VydCb54Z2jbgcIZNJDT0EhdeQxbaC6s0yCB3gsr4jxIsNEcwWK8ASWF9cs193p86_a9GPnAb6dZoZCzeAe34mCGY_Tus7yyVfL61pljAYOJtu-V3AR0VmPERB8I95UctIvaax0n1GlllpMiTvJPG0LVGWHzxpphDmk5qw_tKM93mNJNrbXYVbHisOqFzeEbcKi7481TQUB_TBysJ6uPxGNj8NOz7L_rdscdESRUzrJhEbXYB5PBEXY0H2lcR-N6NacI_PKZIP3DtK7jWIXh3bAgz71f9v7REDpGa2xK-zl4b8rS5EIDzcpWbaCBV_YgHutwec7Fx5Jg75CZ2nbzm80oF_9SeIuoIRBx71JmKqMnZjrz3kyoDZ8Q57u2wDJ_LjK-IAg06Jnb3jA-BMY-roypd85LI0YZd9BfK-LaPxhI4OG7lOsZ8TDiH-Y7nYPzimKTVyjBMs_13g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H2 200 rar Show response
as.ad4m.at/ad/ Frame 9EBA 11 KB
4 KB 46ms
37ms Document
text/html 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0

Requested by

Host: ad4m.at
URL: https://ad4m.at/r62eglto.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

47b18f72e354c918aa18e8c787b01e69a6c9496e7735e1c7f9467ec863d47906

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri ;child-src ;connect-src ;default-src 'self';font-src ;form-action 'none';frame-ancestors * data:;frame-src ;img-src data:;manifest-src 'none';media-src 'none';navigate-to ;object-src 'none';prefetch-src 'none';script-src 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate
cf-cache-status: DYNAMIC
cf-ray: 6feb3eecaee53752-MXP
content-encoding: br
content-security-policy: block-all-mixed-content; report-to report-endpoint;report-uri /ad/rcv; upgrade-insecure-requests;sandbox allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox;base-uri *;child-src *;connect-src *;default-src 'self';font-src *;form-action 'none';frame-ancestors * data:;frame-src *;img-src * data:;manifest-src 'none';media-src 'none';navigate-to *;object-src 'none';prefetch-src 'none';script-src * 'unsafe-inline' 'unsafe-eval';style-src * 'unsafe-inline';worker-src 'none'
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 04:48:07 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: 0
feature-policy: geolocation 'none';midi 'none';sync-xhr 'none';microphone 'none';camera 'none';magnetometer 'none';gyroscope 'none';fullscreen 'none';payment 'none';accelerometer 'none';usb 'none';autoplay 'self'
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
pragma: no-cache
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
server: cloudflare
strict-transport-security: max-age=86400; includeSubDomains; preload
surrogate-control: no-store
vary: accept-encoding
via: 1.1 google
x-content-type-options: nosniff
x-download-options: noopen
x-xss-protection: 1; mode=block

GET
H3 200 default.css
as.ad4m.at/ad/style/0.1.18/one-ad/ Frame 9EBA 81 KB
11 KB 37ms
37ms Stylesheet
text/css 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://as.ad4m.at/ad/style/0.1.18/one-ad/default.css

Requested by

Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0442de55e3838ce2b8cfca9a7ad2a6bcecfd94844453c13b38d7a9f1d31944b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:07 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"failure_fraction":"1.0","max_age":86400,"report_to":"report-endpoint","success_fraction":"0.0","include_subdomains":true}
age: 1167776
cross-origin-embedder-policy: unsafe-none
cf-polished: origSize=83581
surrogate-control: no-store
report-to: {"endpoints":[{"url":"/ad/vre"}],"group":"report-endpoint","max_age":86400}
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=86400; includeSubDomains; preload
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: same-origin
last-modified: Wed, 06 Apr 2022 16:25:11 GMT
server: cloudflare
cross-origin-opener-policy: unsafe-none
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: accept-encoding
x-download-options: noopen
content-type: text/css; charset=utf-8
expires: 0
cache-control: max-age=3600, must-revalidate, proxy-revalidate
cf-ray: 6feb3eed0c5083a2-MXP
cf-bgj: minify

GET
H2 200 E8A0B3404CF65D67FABF74F38D2E787E97D75F650E6720B8A047EFE226A7A598DA94FFCF3CDCC52A3B206A422DD3D5082778689277BC79BF962DEE607C6331D8
assets.ad4m.at/logo/ Frame 9EBA 38 KB
39 KB 50ms
42ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/E8A0B3404CF65D67FABF74F38D2E787E97D75F650E6720B8A047EFE226A7A598DA94FFCF3CDCC52A3B206A422DD3D5082778689277BC79BF962DEE607C6331D8
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d997fba7832cb78b0933a9eb2ce191d53234c978e25c6c8fc50c75923ea8405e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=RkBJ3g==, md5=Kw4C6d3nfjHTjXjXPcaeTw==
date: Wed, 20 Apr 2022 04:48:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 518375
cf-polished: origFmt=png, origSize=77267
x-guploader-uploadid: ADPycdvC2InmMh-zrAR50ZZj4GRb4PITbs3t0e--z8vzdk_8NM4gnF__p5aencKUwD_dZ926qCAcK4U8oxQMKBAAr6ZtqgXO--3m
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 38696
last-modified: Wed, 22 Jan 2020 13:11:48 GMT
server: cloudflare
etag: "2b0e02e9dde77e31d38d78d73dc69e4f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LLCMAHu6kklRIEVaZsD1oPtowG%2FPCikLaKTToVqs0hwBrTTIZ7spw4t3E6XDJcWOemruPWEWE5iwLJPsno1wiB7ibttTLBfLYJXYp%2Bfk%2FA%2F1N%2BELHZVjJJNrzEQMO7N%2FIU7D2%2BYPxFltSyMT"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1579698708801217
content-type: image/webp
expires: Thu, 21 Apr 2022 04:48:07 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 77267
accept-ranges: bytes
cf-ray: 6feb3eed0f943752-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 B45F893E9FFC024BF63F31BCCBD125167CBC3446F3678FC31F706A695A83CDCA7427229BCA4C5992B83E2F60A147FCD1B6148725AA0AF3ABB801A6BB7EA78390
assets.ad4m.at/ Frame 9EBA 84 KB
84 KB 48ms
42ms Image
image/jpeg 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/B45F893E9FFC024BF63F31BCCBD125167CBC3446F3678FC31F706A695A83CDCA7427229BCA4C5992B83E2F60A147FCD1B6148725AA0AF3ABB801A6BB7EA78390
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c3a0321547809818914bf6666db8a6b4f882b487d3e08e334566d25d5d38e55

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=e08Zuw==, md5=psibsHmVB2WUau7aQuE9AQ==
date: Wed, 20 Apr 2022 04:48:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2462308
cf-polished: origSize=90165, status=webp_bigger
x-guploader-uploadid: ADPycdsptdp2JHMudyhma4_tRan-1sTXAWuZeU75iOPGSiSi3VWFAgWEo44SxaKV6Y1BqyBrraPCApnQwJCEnDNAE14
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 85727
last-modified: Wed, 09 Oct 2019 16:06:53 GMT
server: cloudflare
etag: "a6c89bb079950765946aeeda42e13d01"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ujnsP73UzWQA8ptTWB2BHuA0try39Wz6fO4kY4Q32rhs%2F4BWOnp70LVZDvJ3cRhMrS8HKauPsuN4MCgsh0MayIJawl%2BDo0ouif74rP8dklMMCHedceah5Hnnrxj7dQfxSCg4SiWGtwGUdoNX"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1570637213281727
content-type: image/jpeg
expires: Thu, 21 Apr 2022 04:48:07 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 90165
accept-ranges: bytes
cf-ray: 6feb3eed0f8b3752-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
assets.ad4m.at/logo/ Frame 9EBA 53 KB
54 KB 31ms
25ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/D694B3AB12381C049B127B34DC11A792684BA8B6EE8B598D6E4045678591B7D0DC6B2CEF7528F06BB05FC11826A1D16CF24DA68FCFC2416343996FBFC05A3155
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7cdf71044448cb736733f5163fff96081d51ba4101567d61d22ee5998a7a399

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=V11ayA==, md5=Cid9We/KA2mmmDZF4nNlng==
date: Wed, 20 Apr 2022 04:48:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 515446
cf-polished: origFmt=png, origSize=115129
x-guploader-uploadid: ADPycdtEN5BLso_pYq9sWvdXvo3kNoMcEnVBWSjkx4P4RyMSkNOYbidAswbSjObgZTW-DoAkzw-0BYkT95l4-MgF5CUlvzdhSToN
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 54564
last-modified: Tue, 09 Feb 2021 15:11:24 GMT
server: cloudflare
etag: "0a277d59efca0369a6983645e273659e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NxbRedszv4Gina5icXRfDYY9%2Ff%2F%2BxN6n0i6C6E2iPJ%2FxQwEDvZz%2BQrRndCLJNJxBERTN%2B%2BrYlyiff3xh8yYYfWm3sYCaNt4T0uugEY%2FDTqcxqfoJv9mSgoR%2FOYYx2Mnkdrj1ds4ugkh%2BMH6Q"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1612883484779402
content-type: image/webp
expires: Thu, 21 Apr 2022 04:48:07 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 115129
accept-ranges: bytes
cf-ray: 6feb3eed0f8c3752-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 94776D1EA84A2C016C3E2F4F2FF5CAFAE59DCE9271B62B383432451DCE910FAAE81B73D3436E567532B91B0BB75A1A9BC40155D0E940C698B45E520EC40D2A19
assets.ad4m.at/product_image/ Frame 9EBA 10 KB
11 KB 49ms
43ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/94776D1EA84A2C016C3E2F4F2FF5CAFAE59DCE9271B62B383432451DCE910FAAE81B73D3436E567532B91B0BB75A1A9BC40155D0E940C698B45E520EC40D2A19
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6aa4aec3bf9cf0b1c0b6ac8db92c9c0126c3642e0ceb730601a0d2db7083cac3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=Wi8YDA==, md5=y9zKcIdRhNFPsyrXXLJEgg==
date: Wed, 20 Apr 2022 04:48:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 517651
cf-polished: qual=85, origFmt=jpeg, origSize=57873
x-guploader-uploadid: ADPycdvOrX7dc-8UF0XXCNay2SEK5-6lWBqxh1HmhXUNbmOhJFrTU35Te5QUod4PITX4GwYsYGGy4Glt5ywZpdqB01sD3B6fFx6G
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10528
last-modified: Tue, 19 Oct 2021 12:57:42 GMT
server: cloudflare
etag: "cbdcca70875184d14fb32ad75cb24482"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=slqqGS0S3mgiI%2Fk%2FWqWNLKL%2BChPX3Acuxd1go99DdaJRW6ZRvLK0W67HStkHgf2h0MA6nStwTbaRKRM%2FtgYfCZx0NjLg4zuNcn54oz09sB1sXmvfW5xLXOhCHPWPrLDIg4QFaBd1%2BysPd6cn"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1634648262044462
content-type: image/webp
expires: Thu, 21 Apr 2022 04:48:07 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 57873
accept-ranges: bytes
cf-ray: 6feb3eed0f8f3752-MXP
cf-bgj: imgq:85,h2pri

GET
H/1.1

200
OK

/
partner.o2online.de/a/ Frame 9EBA
Redirect Chain

https://www.telefonica-partner.de/tpv.php?t=117679V1226132702M&subid=oneidAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9oneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&gdpr_consent=&g...
https://www.lead-alliance.net/tpv.php?t=117679V1226132702M&subid=oneidAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9oneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&gdpr_consent=&gdpr=...
https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022042006480767345237423X117679V1226132702MSoneidAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9oneid__asuid6JCC1...

49 B
1 KB

89ms
25ms

Image
image/gif

46.4.41.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022042006480767345237423X117679V1226132702MSoneidAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9oneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&spid=2022042006480767345237423X117679V1226132702MSoneidAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9oneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&wfid=117679
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: HTTP/1.1
Server: 46.4.41.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: nonstopads2.sunbonet.de
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 04:48:07 GMT
X-NODEIP: 46.4.41.145
Server: nginx/1.10.3 (Ubuntu)
RM-PrivacyPolicy: https://www.nonstoppartner.net/
P3P: policyref="https://a.nonstoppartner.net/w3c/p3p.a.xml", CP="NOI CUR OUR STP"
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=10
Content-Length: 49

Redirect headers

location: https://partner.o2online.de/a/?i=pview&client=o2&camp=pview&l=de&nw=lea1&affiliate=117679&s_id=2022042006480767345237423X117679V1226132702MSoneidAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9oneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&spid=2022042006480767345237423X117679V1226132702MSoneidAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9oneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&wfid=117679
date: Wed, 20 Apr 2022 04:48:07 GMT
x-content-type-options: nosniff
server: nginx
x-xss-protection: 1; mode=block
content-type: text/html; charset=UTF-8

GET
H2 200 DE7723A3AFDAF019578E8DC48EFCA5260074D3BD31078DAB30E39934BDB537A7756DE8A298EFEBC96FD918DCFB3DF6E8EFF3AA5A7830C15D1026723FEFAFAC4A
assets.ad4m.at/logo/ Frame 9EBA 46 KB
47 KB 47ms
41ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/logo/DE7723A3AFDAF019578E8DC48EFCA5260074D3BD31078DAB30E39934BDB537A7756DE8A298EFEBC96FD918DCFB3DF6E8EFF3AA5A7830C15D1026723FEFAFAC4A
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb99807d9c2d9b98d417acd2a3e897a28cc0829d4815642cb9bd1ab640b98454

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=PRHAtQ==, md5=UfPUXNWo6kuI6N0malNepA==
date: Wed, 20 Apr 2022 04:48:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 460045
cf-polished: origFmt=png, origSize=74333
x-guploader-uploadid: ADPycdujCvRG2c3mYe74axaC6WVROZ5esxMUOHMWeYbV0huVLoDOJPJ1cMYzzWkY5OkZ_gQGPqTAhBh-f_hRulf_ytg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 47320
last-modified: Mon, 11 May 2020 10:44:44 GMT
server: cloudflare
etag: "51f3d45cd5a8ea4b88e8dd266a535ea4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y6CWcZiiuPb4bNMEBrQvFoUkrObChHTVhpkSz6cMqTwfKHglYBlo7%2Ff4S3gXNZeQ6Mdq%2FzEHvlWj9UnOlbnsUFAaNiJS3BsFwG2WNi0AqetxMF89WVP3lTTptMaMTskQ3gYc4fX9n%2F78ocyD"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1589193884048730
content-type: image/webp
expires: Thu, 21 Apr 2022 04:48:07 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 74333
accept-ranges: bytes
cf-ray: 6feb3eed0f933752-MXP
cf-bgj: imgq:85,h2pri

GET
H2 200 E158872B571029E3E20F7B79790588A099EC8F077F856868794A4EA52ED013FC9129FAD340A51F8CD7B6A46733F8D275D86DF117AF4AF8DD766F13FB8A4CAA9A
assets.ad4m.at/product_image/ Frame 9EBA 290 KB
291 KB 31ms
26ms Image
image/webp 2606:4700:20::ac43:4a81
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.ad4m.at/product_image/E158872B571029E3E20F7B79790588A099EC8F077F856868794A4EA52ED013FC9129FAD340A51F8CD7B6A46733F8D275D86DF117AF4AF8DD766F13FB8A4CAA9A
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4a81 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46b98a3787c3de05a63a522c71300ef713f78660098ae524fda5e19bb8567a83

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-goog-hash: crc32c=PFtpQA==, md5=489woOXoZ5LkJrzz2r1hBQ==
date: Wed, 20 Apr 2022 04:48:07 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 514942
cf-polished: origFmt=png, origSize=489686
x-guploader-uploadid: ADPycdt-CDw3Rt6L3gMdvkbO2KvUlXYzTzUtBVIkpBnJB_V-mWMVR5-Zsdh1NAzopuAy5WBk5z1epgjdl6hHFrcSzUNluUTWox6S
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 296674
last-modified: Tue, 17 Nov 2020 11:24:27 GMT
server: cloudflare
etag: "e3cf70a0e5e86792e426bcf3dabd6105"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L32LAnSJArpMprHhkQndek4AxTVf3REtLIzHUhHv7ve8pFRgoCMXK9d7HLf1UVAKqtJSQdebJ6M4usw7DDKcGmIVZ0hVDWV4aYW7oGfA5EJUMB55AtDJAbeAE66hgdtMPYTE91707Vu3l7Nt"}],"group":"cf-nel","max_age":604800}
x-goog-generation: 1605612267020757
content-type: image/webp
expires: Thu, 21 Apr 2022 04:48:07 GMT
cache-control: public, max-age=86400
x-goog-stored-content-length: 489686
accept-ranges: bytes
cf-ray: 6feb3eed0f913752-MXP
cf-bgj: imgq:85,h2pri

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 9EBA 1 KB
2 KB 270ms
139ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=713569&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1ks0fzyg04sphes6w8bmqckp6tpmw10hjmthjagaw2yszmdd659c8k3k7bhjyz2g5wkcqqqd5tjg3cyadg2zsdrha5fbn3sp4bq1vrsfbds0kmme49c3vdh1xndfq49pwr5hamn9bxpqywf2cd7khm2atxe0nq1vacv19mrmyhcwdpr5zd255pz8h92v0ahxq6t0gd9w83gmcs1hfkxmy9p23a36rwdn8fnhtz9qg93f10bm0mdzrk9cne1bpz3asftmqt3dq251t62xnkwtz1gax9jh7rfaaz5n4edp2sv959hcxnbf0%26a%3Dhttps%253A%252F%252Ftrack.adform.net%252FC%252F%253Fbn%253D38689783%253Bcrtbwp%253D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%253Bcrtbdata%253DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%253Badfibeg%253D0%253Bcdata%253DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%253B%253BCREFURL%253Dhttps%25253a%25252f%25252fwheregoes.com%25252ftrace%25252f20222118233%25252f%253BC%253D1%253Bcpdir%253D&clickref=oneidYmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCroneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&viewref=oneidxV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TAoneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: de98f21d929f45871a8d87396f00767ee961794021ae9eaff1f16981760bf392

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:07 GMT
Last-Modified: Wed, 20 Apr 2022 04:48:07 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1468
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 9EBA 1 KB
2 KB 263ms
134ms Script
text/html 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=496305&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1jxj7t2w26br0che2fmk306708ye7m7wn4eheh75hxst0cdsatzvzjcs3spt4as483qrr77ejmgbxnqxp9s7d60qvdp228yd9sqxv5c8zapcyepccf67k44262yehk4q1qz0q793cd8vvdgmmfkvbsaa5vpcsm2c9zvv1t5t5wsk698xeqmpav14vgxxnft2k0qnh5yys5f1a8rgg75bywrahpkzare9xkwm33xs7b5a4xtfcmwwqwb99z82xtvvdkpgepkqcnp3f8f8phbc3m5mrhavm0wk4m25dqzshny8hhxbpw8r8%26a%3Dhttps%253A%252F%252Ftrack.adform.net%252FC%252F%253Fbn%253D38689783%253Bcrtbwp%253D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%253Bcrtbdata%253DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%253Badfibeg%253D0%253Bcdata%253DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%253B%253BCREFURL%253Dhttps%25253a%25252f%25252fwheregoes.com%25252ftrace%25252f20222118233%25252f%253BC%253D1%253Bcpdir%253D&clickref=oneidd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCjoneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&viewref=oneidDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHVoneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 17b76c1cccd44ac1bd497f7bc3d716b95bb63f5626dd3adfebdf2720c276ab75

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:07 GMT
Last-Modified: Wed, 20 Apr 2022 04:48:07 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1446
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7262 42 B
64 B 56ms
40ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssaxnYK1jkv-f-bn9OiWVJ5zpVOWKVPKgRH9vlXLUqeQWznOSsrRiyTb3gBtCcoAOYyS-sYv450JkNbX5BYSMMKddCsE8dKyzA4DIE-zAl_HoWdWIev&sig=Cg0ArKJSzMU2ejLN5YdiEAE&id=lidar2&mcvt=1000&p=1127,276,1217,1004&mtos=26,1000,1000,1000,1000&tos=26,974,0,0,0&v=20220418&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3878002045&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650430086285&rpt=162&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B634 42 B
64 B 53ms
39ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstCGe0AuNjNSQXqjYaD44qNoCD0f7KwvDTat9sz_OnnHET-4HdlimY3gGy1ZGNLTIrkP-95pf858eFzoX6gG9y5ecZy6TmQj410rzxczXpDYqKkndXW&sig=Cg0ArKJSzAKpqKd768zdEAE&id=lidar2&mcvt=1002&p=666,1091,916,1391&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20220418&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650430086281&rpt=176&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 9EBA 51 KB
51 KB 25ms
7ms Script
application/javascript 143.204.98.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=496305&wgcampaignid=1384975&js=1&nw=1&wgtarget=https%3A%2F%2Fas.ad4m.at%2Fad%2Frct%3Fed%3D1jxj7t2w26br0che2fmk306708ye7m7wn4eheh75hxst0cdsatzvzjcs3spt4as483qrr77ejmgbxnqxp9s7d60qvdp228yd9sqxv5c8zapcyepccf67k44262yehk4q1qz0q793cd8vvdgmmfkvbsaa5vpcsm2c9zvv1t5t5wsk698xeqmpav14vgxxnft2k0qnh5yys5f1a8rgg75bywrahpkzare9xkwm33xs7b5a4xtfcmwwqwb99z82xtvvdkpgepkqcnp3f8f8phbc3m5mrhavm0wk4m25dqzshny8hhxbpw8r8%26a%3Dhttps%253A%252F%252Ftrack.adform.net%252FC%252F%253Fbn%253D38689783%253Bcrtbwp%253D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%253Bcrtbdata%253DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%253Badfibeg%253D0%253Bcdata%253DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%253B%253BCREFURL%253Dhttps%25253a%25252f%25252fwheregoes.com%25252ftrace%25252f20222118233%25252f%253BC%253D1%253Bcpdir%253D&clickref=oneidd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCjoneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC&viewref=oneidDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHVoneid__asuid6JCC16dBYRmIOR-x8htvwnDPn_HpfWwqasuid__adf_Netmix_Reach09_DC
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-5.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3900c8b5b423944473f2b5735300291c473881985b2e64318b01fd3d7eefcbd2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-amz-version-id: snQAK.nud_Ry1pExcABmNeZsZtrLXsiU
via: 1.1 d55780b776b171387055eca956ae29a8.cloudfront.net (CloudFront)
last-modified: Wed, 23 Mar 2022 11:22:01 GMT
server: AmazonS3
age: 85471
etag: "101c8120dbcfdb729e8ebf54cc77d0cd"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Tue, 19 Apr 2022 05:03:39 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 52083
x-amz-cf-id: POLNNJ6QW4IEExP_58jUlLdOoNZ2ya00cQEW4jCLIFE_k3DPP_YlzQ==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 9EBA 1 KB
2 KB 98ms
35ms Image
image/png 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1384975&viewref=oneidVQJ6hwfmfJJ1XuVHbHAtRtD6gsBSDtzGTQoneid__asuidU1soGo0tX3lJoQGAsnLqWI8bm63DqyqOasuid__dreamies_advancedad_728x90&wglinkid=496305
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 32b5ea0410bbd7fa1aef6686a84aeb567739bcd71a935ff6214d538b61353f0b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:07 GMT
Last-Modified: Wed, 20 Apr 2022 04:48:07 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 1391
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 9EBA 85 KB
85 KB 97ms
35ms Image
image/png 46.236.13.147
PULSANT-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=1384975&viewref=oneidEbGSDfqQSmEDszHAHjt4t48eTqTVT1dc7oneid__asuidY1FCvSVf34DnPjV6re_LOYusOGN4dg-dasuid__suite_Netmix_Reach13_BlackFridayPush&wglinkid=713569
Requested by: Host: as.ad4m.at
URL: https://as.ad4m.at/ad/rar?a=24673%2C19456%2C56666&b=xV5TQfEKQRcjEGfPHdHztQtRbZfJT6T73TA%2CAz3FYfgzebf7JrfAHRH4tktMMEU7T4T5pT9%2CDzDF3f3rjJtKKbMa3HmH9t1tWKbsWTmTpRHV&f=YmrurfzX9Vc85xFVH9HetgCRBqfAT1TZVCr%2CMz2FzfJRBPhKpDUWHEHGtQC66BT9T4Tzea3%2Cd4PTEfeKZGuYY4AUEHjHwtqCWw4s3T4TZRCj&c=728&d=90&e=6JCC16dBYRmIOR-x8htvwnDPn_HpfWwq&g=f505bdc721c6d5e48d3a0d62df1c78d6%2F1253470272209764381&i=20430%2C20774%2C22427&j=21%2C14%2C21&k=0&l=0&m=0&n=&p=&q=&o=adf_Netmix_Reach09_DC&r=1650430087109&h=https%3A%2F%2Ftrack.adform.net%2FC%2F%3Fbn%3D38689783%3Bcrtbwp%3D0.02628-pFDX-N6A6rpWjTDRq9J_6_n5Utn6OYcN0%3Bcrtbdata%3DFggDXaoXYjbCBdptcyo5RX0nmhyWHcEgY7Vq8r2vy4yQpKQvSFo8ItXGeVhYd8y1jrvt3_gbA9_NotpUPY8BrnNn_FiDNQAKI8Yu0fipInlChzdyVeWanMCsv81eV6zziign30v2ECnxdPk03Y-SMRYQBSqnEJfi-6T_7M1jQDyzFSDL_BSxhgkwkl-qa4BhJg-WemuQs6x3PEyPKqp7m42iWHCKmfaGZPSVCRcBPzE1%3Badfibeg%3D0%3Bcdata%3DJU8iwiXZ5lESc5x_H_hRK9NsrEmeQv7d9AcmZ0KjPTCfU_BosTVSu8E6YHMhGBZ9nzvbPC9QfvUnX3gG84IQEYcqKOAwYwBaQR5MGrGcLjuvPCrSsv5_L0T8zZtcN9GrQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fwheregoes.com%252ftrace%252f20222118233%252f%3BC%3D1%3Bcpdir%3D&y=1&z=0
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN12703 (PULSANT-AS, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 272d25a3bc4e780b90797dc968a382dbccaa40157d7612ace2f59f2768a6bb86

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:07 GMT
Last-Modified: Wed, 20 Apr 2022 04:48:07 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 64D3 42 B
64 B 40ms
39ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssZhFtlRmy1XfXTAjIrcPld0ffkfl69gzhP_IyOookz5ZFWAUWRPRATf8Nd-E7JWoYtQ1SO8oSQKb_VZUHtH0fFCwvwxY5xEiwm6xWId0RyhB8n1V9j&sig=Cg0ArKJSzCHLzQwDM2RhEAE&id=lidar2&mcvt=1000&p=474,436,564,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220418&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650430086276&rpt=250&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 64D3 0
834 B 17ms
17ms Ping
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&e=wqT_3QKJBugJAwAAAwDWAAUBCIWh_pIGEN-Bqu2jtN78RhgAKjYJ7QvohTsXrj8RJKO5BJYSqD8ZAAAAANej4D8hJA0SACkRJMgxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKeiyyVYmNVSYABoz_hreIjbBIABAYoBA1VTRJIFBvSFApgB2AWgAVqoAQGwAQC4AQHAAQXIAQLQAQDYAQDgAQDwAQDYAgDgAp_wP-oCKGh0dHBzOi8vd2hlcmVnb2VzLmNvbS90cmFjZS8yMDIyMjExODIzMy-AAwCIAwGQAwCYAxegAwGqA-oBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUM2dmRVNWEyR2MzS3JubnhNV2JkUHpuY2tMeHg5Zmx1RkM3WktqT05tOXBCbWIxY3NEX19WajJfeHhobXFoRkJDYUpVSEszckJPNXdvRm9SV1lONm9QQ1FxcDhRJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzUxMTQyNTI1ODk1ODIxNTU5OTkiCDc4ODI3ODE1KgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEDS91dC92My9wcmViaWSYBACiBA0xNDYuNzAuMTE3Ljg4qAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBdjx2OjQnbORPMAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcyQJfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMDYxNTcxOTI3OTa6Bw8IABAAGAAgADAAOLYYQADIB4jbBNIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAHuIkMiggCEAA.&s=88f7af388cf39bef689bf9f6f037ed3087643d3e&type=pv&jm=1003&px=436&py=474&bw=728&bh=90&sf=1&sid=1034336911527911260&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:07 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2325feb2-3ef4-44fc-99c0-2136f8daf1e7
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 52B9 0
834 B 55ms
55ms Ping
text/html 185.33.220.100
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F&e=wqT_3QKLBugLAwAAAwDWAAUBCIWh_pIGELmnwpPrsbf2FxgAKjYJwQKYMnBAmz8RNALgjibNlT8ZAAAAANej4D8hNA0SBCnBDSTIMQAAAOBRuJ4_MPXtsws4ykFA5R5IZVChn-kkWJjVUmAAaM_4a3iI2wSAAQGKAQNVU0SSBQbwqpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjIxMTgyMzMvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYQEG9AUBX2I9QUtBbWYtRHBWVTYwRUlIUXJCZDdIZmdhZVVHN0Y4Wk9CWHJnbjRuTlQybjgzN20xNE16VG90dlBWcHFNak1La0xYczRDUW93d3lJc3J4WGVlZFFYS0Y1ZktSX214cGlQb0EmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTcyMzk5NjM2MjMyNDg3NDE2OSIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDTE0Ni43MC4xMTcuODioBACyBBAIABABGKwCIPoBKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBCHWVIgFAZgFAKAFvaCM6Mb0vMJAwAUAyQVBIRwAAPA_0gUJCQkMeAAA2AUB4AUB8AWapkD6BQQIABAAkAYAmAYAuAYAwQYJJSzwP9AG7o8B2gYWChAJEhkBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMzkwNTM3MDUyOboHDwFYSBgAIAAwADi2GEAAyAeI2wTSBw0VhgFHCNoHBgknROAHAOoHAggA8Ae4iQyKCAIQAA..&s=04bfe93f98b3e02506caeffa419ecee6deaeeac4&type=pv&jm=1003&px=1091&py=666&bw=300&bh=250&sf=1&sid=1034336911527911260&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.100 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ec2-54-76-212-160.eu-west-1.compute.amazonaws.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:07 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: b548d2ad-b2e5-405f-b4ae-b4203b712619
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2AC3 42 B
64 B 48ms
47ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsubE4sPjIjDvvSYJFRTAkFCu5jsSCVtvDnlzM-eEqMHX4ocgxKC9MBEzLuRLY8QAl5lUc-A-U2uW1zN2pJ-Y58FJ_gDJ6XFaC9OqgxvunCATj2wVpVUCw&sig=Cg0ArKJSzLYqr9noJkv3EAE&cid=CAASF-Ronx8KrgYoc8YXnta6_IlDXzMgzIU3&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220418&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=2938260542&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650430086469&rpt=234&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3A82 42 B
64 B 44ms
44ms Fetch
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstnRGbHvl8WxwfSt1nM7rQ2aw3TS3pfqPLeCGp2pJ30rmZp-261E_6Vic9Ke0lTt3HJ90KXifr2cqDk-2XU0HRm6WhsN3_4H1Z5tKz2hErN2zTLuCSvDQ&sig=Cg0ArKJSzPQuTzeAR_pdEAE&cid=CAASF-RowHll3VZM44vGEKib0_-WwBfDQL0L&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220418&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650430086435&rpt=490&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:07 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 79ms
37ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8fb8fc201a6f570ebfce0b3504f6da40f0976cd36c20e2983b6e5b172ebf56a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:08 GMT
content-encoding: gzip
last-modified: Tue, 05 Apr 2022 12:58:03 GMT
server: nginx
etag: W/"624c3cdb-17cf9"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 21 Apr 2022 04:48:08 GMT

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 9EBA 16 B
232 B 88ms
88ms Fetch
application/json 54.76.212.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.76.212.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 20 Apr 2022 04:48:08 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 103ms
30ms Preflight 54.76.212.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.212.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-212-160.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 20 Apr 2022 04:48:08 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 9EBA 16 B
232 B 113ms
113ms Fetch
application/json 54.76.212.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.76.212.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-76-212-160.eu-west-1.compute.amazonaws.com

Software

nginx / PHP/7.4.26

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 20 Apr 2022 04:48:08 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.4.26
x-frame-options: SAMEORIGIN
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 99ms
30ms Preflight 54.76.212.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.212.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-212-160.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://as.ad4m.at
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 20 Apr 2022 04:48:08 GMT
server: nginx

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 3A9B 13 KB
5 KB 48ms
16ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

2d97ecc3fc54beb500cfdfaab6e611f49e22c5dbaf368ede1c612e50bfd5099f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-length: 5136
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 04:48:08 GMT
server-processing-duration-in-ticks: 2053
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 62ms
26ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8fb8fc201a6f570ebfce0b3504f6da40f0976cd36c20e2983b6e5b172ebf56a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:08 GMT
content-encoding: gzip
last-modified: Tue, 05 Apr 2022 12:58:03 GMT
server: nginx
etag: W/"624c3cdb-17cf9"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 21 Apr 2022 04:48:08 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 3A9B
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=OaR_7Hx5ckhWdk42bm9pK3AzRlVFRXRkZjdZTWZLMHBmMDdCWHJkU3dkblBmTzh2czhqL2htU0xZeFdpdWJuUzZGbDVPNEd2S0Rzb1FTOTJjR3RjTG9MVnVPWGNWMTJzTFVqaVhUTUNOcDZ1MXV2MG9iNVV1dXdoU3ViNj...

441 B
636 B

59ms
19ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=OaR_7Hx5ckhWdk42bm9pK3AzRlVFRXRkZjdZTWZLMHBmMDdCWHJkU3dkblBmTzh2czhqL2htU0xZeFdpdWJuUzZGbDVPNEd2S0Rzb1FTOTJjR3RjTG9MVnVPWGNWMTJzTFVqaVhUTUNOcDZ1MXV2MG9iNVV1dXdoU3ViNjZrMXdZS3NxbkhxU3dNaDVBbjcyaDZ5ZWg3ZHhBSjljTGZma0ZWaWx1NStIQnltUGZMd0VDTkxtWXdxaHFWNWRtN1FaMEJ2eE5wUzVNU0dQNm5jakNYMk5RTjZGcHRpTk1jUE52NFAzUTQvWkxZanNBL1JhN2RVWXJoTlJLU2RuZGt6R1JvK21GSktxRHJxdEVnVmlTZGlQRHIyb05Vdz09fA&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

25277fa375b0ac787d81fd13e82a0515320aca19c963fd32704096de667b41fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:08 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 5083
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:08 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=OaR_7Hx5ckhWdk42bm9pK3AzRlVFRXRkZjdZTWZLMHBmMDdCWHJkU3dkblBmTzh2czhqL2htU0xZeFdpdWJuUzZGbDVPNEd2S0Rzb1FTOTJjR3RjTG9MVnVPWGNWMTJzTFVqaVhUTUNOcDZ1MXV2MG9iNVV1dXdoU3ViNjZrMXdZS3NxbkhxU3dNaDVBbjcyaDZ5ZWg3ZHhBSjljTGZma0ZWaWx1NStIQnltUGZMd0VDTkxtWXdxaHFWNWRtN1FaMEJ2eE5wUzVNU0dQNm5jakNYMk5RTjZGcHRpTk1jUE52NFAzUTQvWkxZanNBL1JhN2RVWXJoTlJLU2RuZGt6R1JvK21GSktxRHJxdEVnVmlTZGlQRHIyb05Vdz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 2489
content-length: 541
expires: 0

POST
H2 200 /
track.adform.net/serving/unload/ Frame 8698 35 B
467 B 18ms
18ms Ping
image/gif 37.157.2.237
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=0@@38689783,9026869623225216400,81|1101|0|0|0|0|0|0|0||30|0|2401|55e374f0-2883-3b7f-b769-c0a2480606af_1|||1|0|0|AteVpbc6y1zi5nP9TebYOumn3tQYot-A0|||11|0|0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.2.237 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:08 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 8928 52 KB
17 KB 23ms
6ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 84381
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 20 Apr 2022 04:48:09 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 159827, 1193552
X-Served-By: cache-lga21972-LGA, cache-hhn4081-HHN
X-Timer: S1650430089.159134,VS0,VE0

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 510E 281 B
554 B 128ms
13ms Document
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Wed, 20 Apr 2022 04:48:09 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 787F 4 KB
2 KB 8ms
8ms Document
text/html 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1650430085800

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

a2-22-32-24.deploy.static.akamaitechnologies.com

Software

Resource Hash

57e7d2d090f1c83ce3fa21c5125117a1fcce56d51ca55d3e0607d2572b94bf20

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1441
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame 560E 0
0 14ms
14ms Document
text/plain 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Wed, 20 Apr 2022 04:48:09 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Server: nginx
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap6ams1

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 5FAF 8 KB
4 KB 236ms
11ms Document
text/html 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0849eef021b381cb3f64d424bdd29839513dbb4e964aef0420136906426a18de

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Wed, 20 Apr 2022 04:48:08 GMT
etag: "866b66bb3ccc5c8de41913672c69b8f7"
last-modified: Tue, 15 Mar 2022 23:39:48 GMT
server: AmazonS3
x-amz-id-2: e9Gnp5hJn1V9nsQ1u71TwbdGw5fF3bDIViwQnGvwFUWWAG9PeUOhhweCmUXSrXgbVZQEPRSxFN8=
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:a4519585-d31b-4588-8499-6641ec459b43
x-amz-meta-codebuild-content-md5: d97b029b026ab1b5da9f71fc8f6cf19a
x-amz-meta-codebuild-content-sha256: 1bd3623b950dcf081744ebf0150c6ff72edcc5cbd4a3ea8293d7f9c29b2e9c0b
x-amz-request-id: NDB3QGN7C8DJ1KVY
x-azure-ref: 0iZBfYgAAAADSlmrYdFtITZVC7jUW1cNwRlJBRURHRTEwMTAAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
x-azure-ref-originshield: 0l25eYgAAAABlW268sjepQJ95mBFLaNvOQU1TMDRFREdFMTgxMgA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-cache: TCP_HIT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame D66F 23 KB
8 KB 112ms
51ms Document
text/html 2.22.32.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C97%2C55%2C99%2C3012%2C3011%2C3010%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3014%2C337%2C338%2C339%2C70%2C77%2C38%2C182%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229%2C307&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.22.32.24 Milan, Italy, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

56b9c023eacb9a3c007ee9770e261ba0bae75c57767823900757a1d5824f74d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8258
content-type: text/html; charset=UTF-8
date: Wed, 20 Apr 2022 04:48:09 GMT
expires: Fri, 22 Apr 2022 04:48:09 GMT
server: Apache
strict-transport-security: max-age=604800
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame A1F2 258 B
495 B 98ms
98ms Document
text/html 3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1650430086088&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1650429600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: / Express
Resource Hash: cb8223f111e367f49b7019c6cf9a53e2c6c9452173430bccb0d418716c51ac75

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
content-length: 258
content-type: text/html; charset=utf-8
date: Wed, 20 Apr 2022 04:48:09 GMT
etag: W/"102-CBNc/zjNheMos7etqW45cPnlvVs"
expires: -1
pragma: no-cache
vary: Origin
x-powered-by: Express

GET
H2

200

sync
odr.mookie1.com/t/v2/
Redirect Chain

https://onetag-sys.com/usync/?tag=img
https://x.bidswitch.net/sync?ssp=onetag
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=e0fc845d-504d-4045-bd6e-115ebf8be432&ssp=onetag&gdpr=&gdpr_consent=

43 B
356 B

46ms
16ms

Image
image/gif

34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=e0fc845d-504d-4045-bd6e-115ebf8be432&ssp=onetag&gdpr=&gdpr_consent=
Protocol: H2
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: //odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=e0fc845d-504d-4045-bd6e-115ebf8be432&ssp=onetag&gdpr=&gdpr_consent=
Date: Wed, 20 Apr 2022 04:48:09 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

77af625f-9088-4b00-ad56-5f920fc6f40d
onetag-sys.com/sync/i,1/ Frame 787F
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=%2F%2Fonetag-sys.com%2Fsync%2Fi%2C1%2F%5BMM_UUID%5D
https://onetag-sys.com/sync/i,1/77af625f-9088-4b00-ad56-5f920fc6f40d

0
290 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,1/77af625f-9088-4b00-ad56-5f920fc6f40d

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: MT3 4363 5e696a4 master zrh-pixel-x29 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://onetag-sys.com/sync/i,1/77af625f-9088-4b00-ad56-5f920fc6f40d
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 20 Apr 2022 04:48:08 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 787F 0
239 B 62ms
9ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

GET
H2

200

6410691341747174929
onetag-sys.com/sync/i,34/ Frame 787F
Redirect Chain

https://dmp.adform.net/serving/cookie/match?party=1167&cid=A7ciOVCRnF6BbuH55geJIPAV6trHbZWDZE-90iuvLJc
https://dmp.adform.net/serving/cookie/match?CC=1&party=1167&cid=A7ciOVCRnF6BbuH55geJIPAV6trHbZWDZE-90iuvLJc
https://onetag-sys.com/sync/i,34/6410691341747174929

0
290 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,34/6410691341747174929

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
location: https://onetag-sys.com/sync/i,34/6410691341747174929
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

/
onetag-sys.com/match/ Frame 787F
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=386459526686257356

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=386459526686257356

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ec2-52-59-66-68.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e2ef11d5-0c70-4e09-8bc1-af371ded9f36
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=386459526686257356
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 787F 0
239 B 34ms
9ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=A7ciOVCRnF6BbuH55geJIPAV6trHbZWDZE-90iuvLJc
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/gif

GET
H2

204

sync
pixel.advertising.com/ups/58198/ Frame 787F
Redirect Chain

https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true
https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true

0
124 B

9ms
8ms

Image
text/plain

52.59.66.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

52.59.66.68 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

location: https://pixel.advertising.com/ups/58198/sync?&gdpr=1&gdpr_consent=&redir=true&verify=true
date: Wed, 20 Apr 2022 04:48:09 GMT
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 787F
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgEVMl88AqKT8jATvIMwQ9D5OWbUZ5lg37A

170 B
243 B

30ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgEVMl88AqKT8jATvIMwQ9D5OWbUZ5lg37A

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgEVMl88AqKT8jATvIMwQ9D5OWbUZ5lg37A
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1 200
OK sync
ssbsync-global.smartadserver.com/api/ Frame 787F 0
75 B 347ms
24ms Image
text/plain 185.86.139.93
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.93 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
content-length: 0

GET
H2 400 711916.gif
id.rlcdn.com/ Frame 787F 0
0 39ms
15ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711916.gif?ct=4&cv=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 787F
Redirect Chain

https://onetag-sys.com/match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=Xhb5FWu_pYhNAED-W8PnqOieer8JP_KNINQTUVJYFa4

43 B
556 B

383ms
98ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=Xhb5FWu_pYhNAED-W8PnqOieer8JP_KNINQTUVJYFa4

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: VV9QXP7PREM3WQH502XV
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=Xhb5FWu_pYhNAED-W8PnqOieer8JP_KNINQTUVJYFa4
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 787F 0
42 B 950ms
153ms Image
text/plain 192.82.242.208
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.82.242.208 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 787F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEDJTiLsMoBPVoKKLhvjdO_A&google_cver=1

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEDJTiLsMoBPVoKKLhvjdO_A&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEDJTiLsMoBPVoKKLhvjdO_A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 787F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58488/occ
https://ups.analytics.yahoo.com/ups/58488/occ?verify=true
https://onetag-sys.com/match/?int_id=92&uid=y-_YLA0yJE2uHP.Vi7lkTkss2aRlQdQmVPQA_512Y-~A

0
291 B

12ms
12ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=92&uid=y-_YLA0yJE2uHP.Vi7lkTkss2aRlQdQmVPQA_512Y-~A

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=92&uid=y-_YLA0yJE2uHP.Vi7lkTkss2aRlQdQmVPQA_512Y-~A
date: Wed, 20 Apr 2022 04:48:09 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/sync/i,29/ Frame 787F
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/sync/i,29/?tdid=36e88e84-2699-4e82-9bc9-558724d10649&ttl=1653022089

43 B
370 B

7ms
7ms

Image
image/gif

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,29/?tdid=36e88e84-2699-4e82-9bc9-558724d10649&ttl=1653022089

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
cache-control: no-cache, no-transform
content-length: 64
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/sync/i,29/?tdid=36e88e84-2699-4e82-9bc9-558724d10649&ttl=1653022089
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 211

GET
H2

200

/
onetag-sys.com/match/ Frame 787F
Redirect Chain

https://x.bidswitch.net/sync?ssp=onetag
https://c1.adform.net/serving/cookie/match/?party=24&bidswitch_ssp_id=onetag
https://x.bidswitch.net/sync?dsp_id=70&user_id=6410691341747174929&ssp=onetag
https://onetag-sys.com/match/?int_id=30&uid=e0fc845d-504d-4045-bd6e-115ebf8be432&gdpr=&gdpr_consent=&us_privacy=

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=30&uid=e0fc845d-504d-4045-bd6e-115ebf8be432&gdpr=&gdpr_consent=&us_privacy=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?cb=1650430085800

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location: //onetag-sys.com/match/?int_id=30&uid=e0fc845d-504d-4045-bd6e-115ebf8be432&gdpr=&gdpr_consent=&us_privacy=
Date: Wed, 20 Apr 2022 04:48:09 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 8928 0
742 B 17ms
16ms Script
text/html 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 702872d2-48cd-411c-8f11-cbf2601f58e9
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame A1F2 2 KB
1 KB 39ms
13ms Script
application/javascript 104.16.200.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1650430086088&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.200.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Apr 2022 17:01:39 GMT
server: cloudflare
age: 3354
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6feb3efa0c70918e-FRA
content-length: 1168
expires: Wed, 20 Apr 2022 06:48:09 GMT

GET
H2

502

query
ecs.mantisadnetwork.com/sync/pixel/ Frame A1F2
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=36e88e84-2699-4e82-9bc9-558724d10649

0
0

106ms
93ms

Image
text/html

3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=36e88e84-2699-4e82-9bc9-558724d10649
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1650430086088&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F
Protocol: H2
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=36e88e84-2699-4e82-9bc9-558724d10649
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 241

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 510E 32 KB
10 KB 14ms
13ms Script
text/html 23.205.235.133
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.235.133 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-235-133.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: d4d11466f8a21a8c3c96dfaf304aa45107dd8d95687a8da3cb23f49c3d138fb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 04:48:09 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=48868
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9541
Expires: Wed, 20 Apr 2022 18:22:37 GMT

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame A1F2 31 KB
24 KB 12ms
11ms Script
application/javascript 104.16.200.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1650430089297&ver1=2.2.3&qid=83233313f553333313f513430313&rnd=xhc7bok9xxdl&cid=1041
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.200.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 07 Apr 2022 17:01:39 GMT
server: cloudflare
age: 6933
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6feb3efa2ca4918e-FRA
content-length: 24217
expires: Wed, 20 Apr 2022 06:48:09 GMT

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame A1F2 26 B
304 B 52ms
18ms Image
image/gif 2606:4700::6810:79c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1650430089342&rnd=xhc7bok9xxdl&ifm=1&uai=1&cid=1041&s=wheregoes.com&p=undefined&x=&adtg=&ats=0&atf=&nsi=&si=&nci=&nai=&pft=0&iip=0&adb=1&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1650430086088&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:79c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:33 GMT
server: cloudflare
age: 3838
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6feb3efabb1f233d-ZRH
content-length: 26
expires: Wed, 20 Apr 2022 06:48:09 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame A1F2 26 B
88 B 55ms
21ms Image
image/gif 2606:4700::6810:79c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1650430089331285&ver=1.2r81&qid=83233313f553333313f513430313&p=undefined&s=wheregoes.com&x=&cid=1041&od1=&od2=&adtg=&nci=&nai=&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=xhc7bok9xxdl&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&1=27dec25a2c8d270f41761338362fff9f&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1041&ifm=1&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=26&icp=https%253A//wheregoes.com/&irfl=26&irf=https%253A//wheregoes.com/&cty=4&fcs=0&flky=ver-fl-6-qid-fl-28-p-fl-9-s-fl-13-x-fl-0-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-0-nci-fl-0-nai-fl-0-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-&spfp=1&spfnp=0&sp1=Chromefl_andLinux&sp2=Chromefl_andWindows&adv=0&det=1&adb=1&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=0x0&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_9.7_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=18
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1650430086088&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222118233%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:79c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:33 GMT
server: cloudflare
age: 950
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6feb3efabb20233d-ZRH
content-length: 26
expires: Wed, 20 Apr 2022 06:48:09 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/ping/lXwKCPe1ERED7wbFvmmp3C60tbfHxwES-4YrtZkbTrf01KATJWUQoB-Ramra8htk485zM_our9YIRsNJODsedyPQAZauKNX4b6UKzI69fwPbS_kmz01FWxRQok_y9gAew7L2uZGZhtaCGZGMC8fZBFlMBuzb4zoI--ASqCsN30L2w8Ufy8JOSRLoYbXKXQhmaIqbzq-Tkdde4cHMUul1Rw;M877-58yCQPJYq9qTFB9afYs0EdEOpCgptWCJmA4IDA:jiit0vVpqBPmMGlyjXPTNXoLWet8Sj6SyzxLJ-FQwqi2jwcAitc9rViv11M_biSqbuKwaZdGooVsLbp-xTTgds_u2dCFl5lABrusn7mrxqklkLhft72Aio1gUs2zRTHJkW1NezFrhmlhBcd53ZQqnqx-YSdg2AuGgk_8TwuLE0L704SxatKJUjaEyKM7sCFB9UCekRv6EbD8VSr4ZIRHAmJd6Kcx9OIK7hQezKviRaG3H_bjW5jm6k_exPO-IqfA5WC6kg3KCnwmi3oqj0D-2fKgRKLgFK-8f_HS-Yr7YWxOqmdzX7-hQfaWnd-_JajOoUcqFB72RkU5oC6Z3suIjTJY5j-IdWErKimdteBYEPO-d5N-JQ2MvHYFv0J2PdOHKtbZJFfuRXxZugLWht7bptQWTljcwKxNQogwXbw4jkKvgOaFdits6sJGGiuMLHiFbfjgVzrFUIU1tXzWNZmO_0mVfnYTToS9dxSZlDCxBV0ktmUT1YG8R7s6Xidsep8rg6u8nsvY_NS3XcE20a7-eyX6jVarOQyYv1TsuYOJtDwUNKIgzsjqiSKU5O-da6azwQLawnYUs2iK05-W41RXmnwjCE1InCe2_eWzqT8YUIowss2HoV2-fEskCdyCCy2h03oopY3L2fRMo1bdrX7__opQKpuskWPiQSCp99gZ_GM:6:0:0:0:0:0:0:0:c81e4b7d-58dd-47db-8918-20d283932058

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 1AF6 4 KB
2 KB 110ms
31ms Document
text/html 54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b2f12cef460709f715160aea5acabbb9afd42c1714d035e75a4a0ab967554c3c

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Wed, 20 Apr 2022 04:48:09 GMT
etag: W/"0cb1edc976ebb354d545babded1adf132"
server: nginx
timing-allow-origin: *

GET
H2 204 ps
pixel.33across.com/ Frame 7364 0
0 488ms
101ms Document
text/plain 67.202.105.24
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.24 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip24.67-202-105.static.steadfastdns.net
Software: 33XP005 /
Resource Hash

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
server: 33XP005
x-33x-status: 2000208

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 424B 4 KB
2 KB 8ms
8ms Document
text/html 51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

b4c60e3ff773941600f4c9fd60c967ab021d168da229873d807964777ab48071

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1465
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 3E88 877 B
1 KB 154ms
24ms Document
text/html 185.86.139.93
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.93 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 6debf4cbfb46ed8c0063c16167300587270ff9d74f3d6821e30d9dbf03ca4a99

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 877
content-type: text/html
date: Wed, 20 Apr 2022 04:48:08 GMT

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 81D6
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
3 KB

23ms
23ms

Document
text/html

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c6d3e665ae67c6a2da80d9278ad739b807908c4be771ac250e1ae2033466c3eb

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 1590
Content-Type: text/html
Date: Wed, 20 Apr 2022 04:48:09 GMT
Dropped-Udsids: 45|39|230|241|8|105|130|3
Expires: Wed, 20 Apr 2022 04:48:09 GMT
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache
Vary: Is-Traffic-Usersync

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 311
Content-Type: text/html; charset=iso-8859-1
Date: Wed, 20 Apr 2022 04:48:09 GMT
Expires: Wed, 20 Apr 2022 04:48:09 GMT
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H2

200

sync
ads.servenobid.com/ Frame 5FAF
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=386459526686257356

0
344 B

30ms
29ms

Image
image/avif

52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=386459526686257356
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 38349f05-4a69-42b2-91c7-790182dbfa75
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=386459526686257356
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 5FAF
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=3bf262469a90925d41710239

0
347 B

30ms
29ms

Image
image/avif

52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=3bf262469a90925d41710239
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=3bf262469a90925d41710239
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap5ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 5FAF 0
277 B 16ms
14ms Image
text/plain 216.52.2.30
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.30 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Wed, 20 Apr 2022 04:48:09 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap6ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET

sync
ads.servenobid.com/ Frame 5FAF
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1650430089436
https://ads.servenobid.com/sync?pid=321&uid=OPTOUT

0
0

GET
H2

200

sync
ads.servenobid.com/ Frame 5FAF
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5140084920487530918

0
344 B

30ms
30ms

Image
image/avif

52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5140084920487530918
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5140084920487530918
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame 5FAF 0
478 B 67ms
13ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 5FAF
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=da90b7b3-f5ed-410e-aad9-eb87f199634b&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
356 B

29ms
29ms

Image
image/avif

52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=da90b7b3-f5ed-410e-aad9-eb87f199634b&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=da90b7b3-f5ed-410e-aad9-eb87f199634b&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Wed, 20 Apr 2022 04:48:09 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET

sync
ads.servenobid.com/ Frame 5FAF
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ads.servenobid.com/sync?pid=337&uid=y-_YLA0yJE2uHP.Vi7lkTkss2aRlQdQmVPQA_512Y-~A

0
0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 510E
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/pWqWIAaETymR4mSG3g4suMn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5850214019844645400

0
239 B

17ms
9ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5850214019844645400
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/gif

Redirect headers

date: Wed, 20 Apr 2022 04:48:09 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=5850214019844645400
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 510E
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L273GKGF-27-EK8Z&sigv=1&esig=2~74962d72c9e1ac3cfb0d0f099744fa6e978472dd

0
47 B

19ms
13ms

Image
text/plain

2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L273GKGF-27-EK8Z&sigv=1&esig=2~74962d72c9e1ac3cfb0d0f099744fa6e978472dd

Protocol

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L273GKGF-27-EK8Z&sigv=1&esig=2~74962d72c9e1ac3cfb0d0f099744fa6e978472dd
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 510E 70 B
264 B 33ms
33ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 510E
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=rsVQtCSrTxKV3HZCGY9iQA&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=rsVQtCSrTxKV3HZCGY9iQA

43 B
556 B

37ms
36ms

Image
image/gif

52.94.222.140
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=rsVQtCSrTxKV3HZCGY9iQA

Protocol

HTTP/1.1

Server

52.94.222.140 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 9ZDAS1YFGG30S5C77AVF
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=rsVQtCSrTxKV3HZCGY9iQA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 510E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELuNBhBDYlzfXDmdxpOeWJI&google_cver=1

0
239 B

9ms
9ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELuNBhBDYlzfXDmdxpOeWJI&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESELuNBhBDYlzfXDmdxpOeWJI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 510E
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=cV_aQM53Tb2fFT1bJt9lUQ&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=cV_aQM53Tb2fFT1bJt9lUQ

43 B
556 B

101ms
101ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=cV_aQM53Tb2fFT1bJt9lUQ

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: WMAW9Y9XC672M1RGYX5S
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=cV_aQM53Tb2fFT1bJt9lUQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 510E
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTA1N2ViYmIyMmM3YTA5MmYwODA0NWUzYmVkYTQzYjI0MmM4NjY4Yg

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTA1N2ViYmIyMmM3YTA5MmYwODA0NWUzYmVkYTQzYjI0MmM4NjY4Yg

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MTA1N2ViYmIyMmM3YTA5MmYwODA0NWUzYmVkYTQzYjI0MmM4NjY4Yg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 510E
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L273GKGF-27-EK8Z

0
708 B

199ms
181ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L273GKGF-27-EK8Z
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
x-li-pop: afd-prod-lor1-x
x-msedge-ref: Ref A: 2545FBC8F1644D33958E26583BF8BC48 Ref B: FRAEDGE0906 Ref C: 2022-04-20T04:48:09Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lor1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXdDrM3jHiVND8OOdLa6w==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L273GKGF-27-EK8Z
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 424B
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgEVMmMmsMM790W-hTZCfTx5dPTSoZSPhXw

170 B
188 B

21ms
16ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgEVMmMmsMM790W-hTZCfTx5dPTSoZSPhXw

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABgEVMmMmsMM790W-hTZCfTx5dPTSoZSPhXw
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 424B
Redirect Chain

https://onetag-sys.com/match/?int_id=113&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=BdxFkXaTl7y6b0ZAWpz4G90pObZt5ZvzCLhIBoNFo0E

43 B
556 B

276ms
99ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=BdxFkXaTl7y6b0ZAWpz4G90pObZt5ZvzCLhIBoNFo0E

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 6B18B5EAT6255NP39SJK
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=BdxFkXaTl7y6b0ZAWpz4G90pObZt5ZvzCLhIBoNFo0E
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

/
onetag-sys.com/match/ Frame 424B
Redirect Chain

https://x.bidswitch.net/sync?ssp=onetag
https://p.rfihub.com/cm?in=1&pub=20513&ssp=onetag
https://x.bidswitch.net/sync?dsp_id=119&user_id=5140084920487530918&expires=30&ssp=onetag
https://onetag-sys.com/match/?int_id=30&uid=e0fc845d-504d-4045-bd6e-115ebf8be432&gdpr=&gdpr_consent=&us_privacy=

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=30&uid=e0fc845d-504d-4045-bd6e-115ebf8be432&gdpr=&gdpr_consent=&us_privacy=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Location: //onetag-sys.com/match/?int_id=30&uid=e0fc845d-504d-4045-bd6e-115ebf8be432&gdpr=&gdpr_consent=&us_privacy=
Date: Wed, 20 Apr 2022 04:48:09 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

77af625f-9088-4b00-ad56-5f920fc6f40d
onetag-sys.com/sync/i,1/ Frame 424B
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=%2F%2Fonetag-sys.com%2Fsync%2Fi%2C1%2F%5BMM_UUID%5D
https://onetag-sys.com/sync/i,1/77af625f-9088-4b00-ad56-5f920fc6f40d

0
290 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,1/77af625f-9088-4b00-ad56-5f920fc6f40d

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: MT3 4363 5e696a4 master zrh-pixel-x30 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://onetag-sys.com/sync/i,1/77af625f-9088-4b00-ad56-5f920fc6f40d
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 20 Apr 2022 04:48:08 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 424B 0
239 B 9ms
8ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Content-Type: image/gif

GET
H2

200

6410691341747174929
onetag-sys.com/sync/i,34/ Frame 424B
Redirect Chain

https://dmp.adform.net/serving/cookie/match?party=1167&cid=Qt0UZliuI0wkYmjV4ews3xw4hsKlK7c71TXM5tBdUIc
https://onetag-sys.com/sync/i,34/6410691341747174929

0
290 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,34/6410691341747174929

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
location: https://onetag-sys.com/sync/i,34/6410691341747174929
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

/
onetag-sys.com/match/ Frame 424B
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D0%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=386459526686257356

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=386459526686257356

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 0437d429-0555-42d4-8cc6-fa6c5753e95a
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://onetag-sys.com/match/?int_id=98&gdpr=0&gdpr_consent=&uid=386459526686257356
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 424B 0
239 B 9ms
7ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=Qt0UZliuI0wkYmjV4ews3xw4hsKlK7c71TXM5tBdUIc
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Content-Type: image/gif

GET
H2

200

y-3rAFUKtE2uF4iVVQrs.eANkb3ixYjTop~A~UP137001a5-c065-11ec-82ed-06d04d0fd94c
onetag-sys.com/sync/i,39/ Frame 424B
Redirect Chain

https://pixel.advertising.com/ups/58198/sync?&gdpr=0&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58198/sync?&gdpr=0&gdpr_consent=&redir=true&apid=UP137001a5-c065-11ec-82ed-06d04d0fd94c
https://onetag-sys.com/sync/i,39/y-3rAFUKtE2uF4iVVQrs.eANkb3ixYjTop~A~UP137001a5-c065-11ec-82ed-06d04d0fd94c

0
290 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,39/y-3rAFUKtE2uF4iVVQrs.eANkb3ixYjTop~A~UP137001a5-c065-11ec-82ed-06d04d0fd94c

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/sync/i,39/y-3rAFUKtE2uF4iVVQrs.eANkb3ixYjTop~A~UP137001a5-c065-11ec-82ed-06d04d0fd94c
date: Wed, 20 Apr 2022 04:48:09 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 424B
Redirect Chain

https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=0&gdpr_consent=&us_privacy=1YN-&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
https://onetag-sys.com/match/?int_id=107&uid=3856632919878934720

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=107&uid=3856632919878934720

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=107&uid=3856632919878934720
date: Wed, 20 Apr 2022 04:48:09 GMT
content-length: 0

GET
H2 400 711916.gif
id.rlcdn.com/ Frame 424B 0
0 17ms
15ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/711916.gif?ct=4&cv=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H2

200

/
onetag-sys.com/match/ Frame 424B
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID
https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=0&gdpr_consent=&us_privacy=1YN-&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26uid%3D%23PMUID&rdf=1
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTk2RTYyNDgtQzNGMC00RDYzLTgxRjItQTAwRDZBMDA0QjFC&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=
https://onetag-sys.com/match/?int_id=114&uid=996E6248-C3F0-4D63-81F2-A00D6A004B1B

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=114&uid=996E6248-C3F0-4D63-81F2-A00D6A004B1B

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=114&uid=996E6248-C3F0-4D63-81F2-A00D6A004B1B
date: Wed, 20 Apr 2022 04:48:09 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 108
content-type: text/html; charset=utf-8

GET
H2

200

/
onetag-sys.com/match/ Frame 424B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEDJTiLsMoBPVoKKLhvjdO_A&google_cver=1

0
291 B

8ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEDJTiLsMoBPVoKKLhvjdO_A&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEDJTiLsMoBPVoKKLhvjdO_A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 424B
Redirect Chain

https://ups.analytics.yahoo.com/ups/58488/occ
https://onetag-sys.com/match/?int_id=92&uid=y-_YLA0yJE2uHP.Vi7lkTkss2aRlQdQmVPQA_512Y-~A

0
291 B

7ms
7ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=92&uid=y-_YLA0yJE2uHP.Vi7lkTkss2aRlQdQmVPQA_512Y-~A

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=92&uid=y-_YLA0yJE2uHP.Vi7lkTkss2aRlQdQmVPQA_512Y-~A
date: Wed, 20 Apr 2022 04:48:09 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/sync/i,29/ Frame 424B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=0&gdpr_consent=
https://onetag-sys.com/sync/i,29/?tdid=36e88e84-2699-4e82-9bc9-558724d10649&ttl=1653022089

43 B
370 B

7ms
7ms

Image
image/gif

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/sync/i,29/?tdid=36e88e84-2699-4e82-9bc9-558724d10649&ttl=1653022089

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
cache-control: no-cache, no-transform
content-length: 64
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://onetag-sys.com/sync/i,29/?tdid=36e88e84-2699-4e82-9bc9-558724d10649&ttl=1653022089
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 211

GET
H2 200 sync
ads.servenobid.com/ Frame 424B 0
364 B 31ms
30ms Image
image/avif 52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=318&uid=Qt0UZliuI0wkYmjV4ews3xw4hsKlK7c71TXM5tBdUIc
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 81D6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=Yl.QiQFe8RIwAe1jtqBnegAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAlSNX2glK4Uh50V3rirzfk&google_cver=1&gdpr=1&google_hm=2

43 B
1 KB

21ms
19ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAlSNX2glK4Uh50V3rirzfk&google_cver=1&gdpr=1&google_hm=2
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 04:48:09 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEAlSNX2glK4Uh50V3rirzfk&google_cver=1&gdpr=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 341
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 81D6 70 B
264 B 33ms
33ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 81D6 170 B
188 B 17ms
16ms Image
image/png 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=Yl-QiQFe8RIwAe1jtqBnegAABI8AAAAB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-19-103-233.eu-west-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 81D6
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yl-QiQFe8RIwAe1jtqBnegAABI8AAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yl-QiQFe8RIwAe1jtqBnegAABI8AAAAB&dcc=t

43 B
645 B

97ms
97ms

Image
image/gif

209.54.180.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yl-QiQFe8RIwAe1jtqBnegAABI8AAAAB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

209.54.180.3 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: N9RS8V23RZD3T4S9PMQS
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: YPEFRSB5HXVT0D66C4Z3
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=Yl-QiQFe8RIwAe1jtqBnegAABI8AAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 81D6
Redirect Chain

https://beacon.lynx.cognitivlabs.com/ix.gif
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=9291f1ed-724d-44bc-b0a2-9f1863e714af&expiration=1681966089

43 B
1 KB

22ms
22ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=9291f1ed-724d-44bc-b0a2-9f1863e714af&expiration=1681966089
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 04:48:09 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=8&external_user_id=9291f1ed-724d-44bc-b0a2-9f1863e714af&expiration=1681966089
date: Wed, 20 Apr 2022 04:48:09 GMT
server: Kestrel
content-length: 0

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 81D6
Redirect Chain

https://d.adroll.com/cm/index/ssp?gdpr=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0

43 B
1 KB

22ms
22ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 04:48:09 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx/1.20.0
content-length: 76

GET
H/1.1 200
OK ie
match.prod.bidr.io/cookie-sync/ Frame 81D6 43 B
430 B 127ms
29ms Image
image/gif 52.19.103.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/ie?gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.19.103.233 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: nginx
strict-transport-security: max-age=2592000; includeSubDomains
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
content-type: image/gif
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 81D6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=15&redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D3%26external_user_id%3D%5BMM_UUID%5D&gdpr=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=77af625f-9088-4b00-ad56-5f920fc6f40d&gdpr=1&gdpr_consent=

43 B
1009 B

58ms
19ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=77af625f-9088-4b00-ad56-5f920fc6f40d&gdpr=1&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 04:48:09 GMT

Redirect headers

Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: MT3 4363 5e696a4 master zrh-pixel-x13 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=3&external_user_id=77af625f-9088-4b00-ad56-5f920fc6f40d&gdpr=1&gdpr_consent=
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 20 Apr 2022 04:48:08 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 81D6 0
356 B 30ms
29ms Image
image/avif 52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=Yl-QiQFe8RIwAe1jtqBnegAABI8AAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://rtb.gumgum.com/usersync?b=apn&i=386459526686257356

35 B
208 B

37ms
36ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=386459526686257356
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:09 GMT
X-Proxy-Origin: 146.70.117.88; 146.70.117.88; 399.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 64377879-28d6-4d55-82b3-e01f5a37fe6b
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb.gumgum.com/usersync?b=apn&i=386459526686257356
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_198ae9a5-d9a4-451a-86c6-d087c3326217&gdpr=0&gdpr_consent=&us_privacy=1---
https://t.pswec.com/bsw_sync?ssp=gumgum2&bsw_user_id=e0fc845d-504d-4045-bd6e-115ebf8be432
https://t.pswec.com/ul_cb/bsw_sync?ssp=gumgum2&bsw_user_id=e0fc845d-504d-4045-bd6e-115ebf8be432
https://x.bidswitch.net/sync?dsp_id=2&user_id=4feb561c-a967-46cc-ad49-e6dd34325b37&expires=3&user_group=1&ssp=gumgum2
https://rtb.gumgum.com/usersync?b=bsw&i=e0fc845d-504d-4045-bd6e-115ebf8be432

35 B
208 B

37ms
36ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=e0fc845d-504d-4045-bd6e-115ebf8be432
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:10 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: //rtb.gumgum.com/usersync?b=bsw&i=e0fc845d-504d-4045-bd6e-115ebf8be432
Date: Wed, 20 Apr 2022 04:48:10 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H2

200

c.gif
c.bing.com/ Frame 1AF6
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28lkLzTlYXABKaVJuyhnKDBFVHDjdjVpQyHgq77rwEOix2UGLV-C7Qk_fULABhURMx%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_198ae9a5-d9a4-451a-86c6-d087c3326217&obuid=ENC(lkLzTlYXABKaVJuyhnKDBFVHDjdjVpQyHgq77rwEOix2UGLV-C7Qk_fULABhURMx)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D

42 B
595 B

57ms
30ms

Image
image/gif

2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
etag: "8120eaf0ff3ad81:0"
last-modified: Fri, 18 Mar 2022 19:39:54 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 45B01851D6694CE8B0BC270B7E37DD53 Ref B: FRAEDGE1220 Ref C: 2022-04-20T04:48:10Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

Location: https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Date: Wed, 20 Apr 2022 04:48:10 GMT
X-TraceId: 4b5df8592a90510fff1752a9311d2f5b
Content-Length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://rtb.gumgum.com/usersync?b=opx&i=49b5f4a4-c733-46a2-849b-c8c6dc7b3a6c

35 B
208 B

36ms
35ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=opx&i=49b5f4a4-c733-46a2-849b-c8c6dc7b3a6c
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Wed, 20 Apr 2022 04:48:09 GMT
content-encoding: gzip
server: OXGW/18.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://rtb.gumgum.com/usersync?b=opx&i=49b5f4a4-c733-46a2-849b-c8c6dc7b3a6c
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-c954de1d-018e-4477-5ac2-1384a9826da6$ip$146.70.117.88

35 B
208 B

36ms
36ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-c954de1d-018e-4477-5ac2-1384a9826da6$ip$146.70.117.88
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-c954de1d-018e-4477-5ac2-1384a9826da6$ip$146.70.117.88
Date: Wed, 20 Apr 2022 04:48:09 GMT
Connection: keep-alive
Content-Length: 122
Content-Type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=oth&i=y-e_aZaxFE2peD5Buh_ay7h7KrKSwTYfkJnEKm~A

35 B
208 B

36ms
35ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=oth&i=y-e_aZaxFE2peD5Buh_ay7h7KrKSwTYfkJnEKm~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Wed, 20 Apr 2022 04:48:09 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://rtb.gumgum.com/usersync?b=oth&i=y-e_aZaxFE2peD5Buh_ay7h7KrKSwTYfkJnEKm~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
https://rtb.gumgum.com/usersync?b=vnt&i=13d63d33-c065-11ec-87a7-b9b37629a584

35 B
208 B

36ms
36ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=vnt&i=13d63d33-c065-11ec-87a7-b9b37629a584
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=vnt&i=13d63d33-c065-11ec-87a7-b9b37629a584
Date: Wed, 20 Apr 2022 04:48:09 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 13d63d34-c065-11ec-87a7-b9b37629a584

GET
H2 204 services
sync.technoratimedia.com/ Frame 1AF6 0
293 B 307ms
94ms Image
text/plain 150.136.26.45
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 150.136.26.45 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 751859593
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame 1AF6 0
44 B 284ms
91ms Image
text/plain 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
content-length: 0
server: c

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_198ae9a5-d9a4-451a-86c6-d087c3326217&gdpr=0&gdpr_consent=&us_privacy=1---
https://stags.bluekai.com/site/23178?id=vva3I6un9WIoPIGK2lSl&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT25TWMEZUSNTVNY4VOSLPKBEUOSZSNRJWYJTVONPXA...
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=vva3I6un9WIoPIGK2lSl&us_privacy=1---

35 B
208 B

40ms
40ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=vva3I6un9WIoPIGK2lSl&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:10 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 04:48:10 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=vva3I6un9WIoPIGK2lSl&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 118
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

usersync
usersync.gumgum.com/ Frame 1AF6
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=7877df0f-bf25-443e-9f40-55e5f85872e0

35 B
296 B

36ms
36ms

Image
image/gif

34.241.76.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=7877df0f-bf25-443e-9f40-55e5f85872e0
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 34.241.76.6 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-241-76-6.eu-west-1.compute.amazonaws.com
Software: envoy /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: envoy
content-type: image/gif
cache-control: private, no-store, must-revalidate, max-age=0
x-envoy-upstream-service-time: 5
x-region: ireland
content-length: 35
expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=7877df0f-bf25-443e-9f40-55e5f85872e0
date: Wed, 20 Apr 2022 04:48:09 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/floor6?zcc=1&cb=1650430089530
https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT

35 B
208 B

36ms
36ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: Tengine
etag: OPTOUT
content-type: text/html
location: https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame 1AF6
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=YVD9O2rNOWVq&ev=1&pid=558355

35 B
208 B

43ms
43ms

Image
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=YVD9O2rNOWVq&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 04:48:09 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://rtb.gumgum.com/usersync?b=pln&i=YVD9O2rNOWVq&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-5d5cc85d5f-gxvvp
expires: -1

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 1AF6 0
75 B 24ms
24ms Image
text/plain 185.86.139.93
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.93 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 1AF6 0
357 B 34ms
29ms Image
image/avif 52.16.214.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_198ae9a5-d9a4-451a-86c6-d087c3326217
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.16.214.41 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-214-41.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 04:48:09 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 0855
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=77af625f-9088-4b00-ad56-5f920fc6f40d&gdpr=0&gdpr_consent=

35 B
208 B

44ms
36ms

Document
image/gif

54.194.100.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=77af625f-9088-4b00-ad56-5f920fc6f40d&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.100.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-100-43.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Wed, 20 Apr 2022 04:48:09 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Wed, 20 Apr 2022 04:48:09 GMT
Expires: Wed, 20 Apr 2022 04:48:08 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4363 5e696a4 master zrh-pixel-x2 config:1.0.0
location: https://rtb.gumgum.com/usersync?b=mmh&i=77af625f-9088-4b00-ad56-5f920fc6f40d&gdpr=0&gdpr_consent=

GET
H/1.1

200
OK

usersync Show response
usersync.gumgum.com/ Frame C9E9
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=Yl_QiQADS46E7wAZ
https://usersync.gumgum.com/usersync?b=atm&i=Yl_QiQADS46E7wAZ&gdpr=0&gdpr_consent=&_test=Yl_QiQADS46E7wAZ

35 B
296 B

130ms
35ms

Document
image/gif

34.241.76.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=Yl_QiQADS46E7wAZ&gdpr=0&gdpr_consent=&_test=Yl_QiQADS46E7wAZ
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.241.76.6 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-241-76-6.eu-west-1.compute.amazonaws.com
Software: envoy /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif
date: Wed, 20 Apr 2022 04:48:09 GMT
expires: 0
pragma: no-cache
server: envoy
x-envoy-upstream-service-time: 5
x-region: ireland

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Wed, 20 Apr 2022 04:48:09 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=Yl_QiQADS46E7wAZ&gdpr=0&gdpr_consent=&_test=Yl_QiQADS46E7wAZ
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-hhn4046-HHN
x-timer: S1650430090.639025,VS0,VE0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 900C 170 B
188 B 18ms
17ms Document
image/png 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV8xOThhZTlhNS1kOWE0LTQ1MWEtODZjNi1kMDg3YzMzMjYyMTc=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS