wheregoes.com Open in urlscan Pro
138.197.62.132 Public Scan

Software

sffe /

Resource Hash

e680f84f5a15d5113b3d271f4f26456bbdd12103f70eaaf21ab08ef68aee9753

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:11:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2928
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127685
x-xss-protection: 0
last-modified: Thu, 05 May 2022 08:34:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 10 May 2023 16:11:26 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 94 B
719 B 123ms
39ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wheregoes.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3eb7350a0588ff4e1af60592b47c3a3c535379bf789126fcdf9737d2e80057e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0
expires: Tue, 10 May 2022 17:00:14 GMT

GET
H2 200 CEAIT5QE.json Show response
srv.buysellads.com/ads/ 934 B
671 B 74ms
17ms Fetch
application/json 64.227.38.224
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.buysellads.com/ads/CEAIT5QE.json?forcebanner=451101&ignoretargeting=yes
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 64.227.38.224 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-eu-ldn-17.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: 5b4dcd0e49ff9a90fdd604fdfbfeb60ceeab587218c2ace9767aedd206141cbf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
server: //srv.buysellads.com
content-length: 558
vary: Accept-Encoding
content-type: application/json; charset=utf-8

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 162ms
83ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=395b7c6d-f509-4148-9227-f2ad8778e9b6&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.742241200103793
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0ef82bbcd8a2c05bcba934ad1b023149f4013c51cda21e065a886b9819797b00

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:15 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
1 KB 167ms
86ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=0f2e5144-a1ba-4e1d-8ef1-dd126559acfb&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.9881873687015894
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: cf4dcbbe69e53d176c77afd6b01b8cf3ed8371eb177ea959b473c39d02478d17

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:15 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 174ms
93ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=2%2C16&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=e90e1da2-1f42-4cfe-9eed-a96d03ccc88a&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.804751819462199
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 67b6e0a6c091d16acbdac53b02419634ace722ad0e4ce5d12a16db0cad8168e0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:15 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 265 B
1 KB 227ms
123ms XHR
application/json 2602:803:c003:200::61
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=00c0b85a-d906-45b7-b076-11a06be38a55&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.3981012511430895
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c003:200::61 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 699ea61ec9e454f0aa385a2b1dc78b249d39a59e8aa957ffd675b3a3e2c45314

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:15 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 265
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 76 KB
23 KB 373ms
337ms XHR
application/json 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

bidder.am5.vip.prod.criteo.com

Software

nginx/1.21.3 /

Resource Hash

1a59fea705b88ac2056c440dcccd195f4e82549732b882b1e206c28364b87915

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 10 May 2022 17:00:15 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 737351c7-1444-4045-84fd-5ff70c3eace1
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 400 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
331 B 339ms
117ms XHR
text/html 3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1652202015029&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&measurable=true&bids[0][bidId]=121374b9c1698d5&bids[0][config][property]=WhereGoes&bids[0][config][zone]=Wheregoes_S2S_Leaderboard_ATF_ROS&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[1][bidId]=138b90ac038403a&bids[1][config][property]=WhereGoes&bids[1][config][zone]=Wheregoes_S2S_Sidebar_ROS_Pos1&bids[1][sizes][0][width]=300&bids[1][sizes][0][height]=250&bids[2][bidId]=14694b6fe35e6ce&bids[2][config][property]=WhereGoes&bids[2][config][zone]=Wheregoes_S2S_Leaderboard_InContent_BTF_ROS&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&bids[2][sizes][1][width]=300&bids[2][sizes][1][height]=250&bids[2][sizes][2][width]=336&bids[2][sizes][2][height]=280&bids[3][bidId]=156f20cd1bf6ff1&bids[3][config][property]=WhereGoes&bids[3][config][zone]=Wheregoes_S2S_Sticky_Sidebar_ROS_Pos2&bids[3][sizes][0][width]=300&bids[3][sizes][0][height]=250&bids[3][sizes][1][width]=120&bids[3][sizes][1][height]=600&bids[3][sizes][2][width]=160&bids[3][sizes][2][height]=600&bids[3][sizes][3][width]=300&bids[3][sizes][3][height]=600&property=WhereGoes&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5352720a5ffb778e42dbb1d4b81c975c02018dd660e1fe9c430cbf13dba78762

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:15 GMT
x-powered-by: Express
etag: W/"38-oN4RNSEETikJBvZER0pAAAEOHrw"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 178ms
108ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280a57d4001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 09da6ae045f3a952ffcd9559e436fd7ce870315215c051cee552017524aec534

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 167ms
96ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: c42bc8c4c8bc480b403a5fec025a3ea0154d136ddc957a92e035c62c32454faa

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 169ms
99ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: b1b7830e36fddd65bde5376bc7da903952dc9aa53f4b96df60abd76bb9a2cf01

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
290 B 149ms
79ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 827bd66b9ba96a978b4882b090bb8aaf9e6042b84b5fc3fb7f66d8b25ce0ee7f

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 159ms
89ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 1e4ce2caa08364901d8c4a05ea40d0608e04718220d065eac3ae3163f653391b

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 164ms
94ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280be73c001e&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: a932aa7ceb1b786d0a82d79914654b7c77003e4ac53aa4b9d63ed5051921ceb9

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 164ms
95ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 1354a04f6b15bd111ba2fe363d0415a09ee1ad424babd67316829ed748e55dae

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 156ms
87ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280c36f30017&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: de5952ef7b3a7bde3d4bc1e0c287e5fb77e401ec89249200fc38a08cb866e4d8

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 158ms
89ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280cdbc80018&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: d70f9fe86b024d18ccb147ad94e775b0dc97f249fcef1d44b0fa6ddebb02aabc

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 93 B
743 B 143ms
100ms XHR
application/json 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.43.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: 86c016e0bc1d997e6115c997b38b8b6fbad3ae4daf958a386d087999a846cff5

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 10 May 2022 17:00:15 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 98

POST
H2 200 adreq Show response
ads.servenobid.com/ 475 B
596 B 348ms
274ms XHR
application/json 52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=4868
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 105f4c6bceb9ed81a6f98c65c051f535dc4d64ab3e8a60da73f95443a1dafd36

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
897 B 134ms
84ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: b26f3e38f8888f3d9ab61990cf28667f08969e57aa03a806e7e74b71a93256e1

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 291ms
37ms XHR
application/json 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=195511843

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 712 B
1 KB 240ms
167ms XHR
application/json 185.255.84.150
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&PublisherDomain=https%3A%2F%2Fwheregoes.com

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.150 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

c0cdaea8540ec79b42b5157629e9454cdbf1f483fa4ffcafc3adcfbf831bec8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:14 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 137
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 712
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
360 B 31ms
7ms XHR
application/json 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://wheregoes.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 132ms
47ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 129ms
47ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 113 KB
26 KB 193ms
126ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4440442240957361&correlator=3098420674252903&eid=31060545%2C31065455%2C31065401&output=ldjh&gdfp_req=1&vrg=2022050501&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Leaderboard_InContent_BTF_ROS%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%2C300x250%2C320x50%7C728x90%7C300x250%7C336x280%2C300x250%7C120x600%7C160x600%7C300x600&fluid=0%2C0%2Cheight%2C0&ifi=1&adks=1696759606%2C2861055222%2C3878002045%2C3809685794&sfv=1-0-38&ecs=20220510&fsapi=false&prev_scp=optimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26hb_size_appnexus%3D728x90%26hb_pb_appnexus%3D0.02%26hb_adid_appnexus%3D7348c4a8721fa4b%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D728x90%26hb_pb%3D0.02%26hb_creative%3D78827815%26hb_adid%3D7348c4a8721fa4b%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.02%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D741e9d4eadb3c73%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_creative%3D77221793%26hb_adid%3D741e9d4eadb3c73%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.00%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318314037-7_123456%26optimize_inview%3Dfalse%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D753adfe8d90c4a5%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_creative%3D309359270%26hb_adid%3D753adfe8d90c4a5%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.00%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D76b7fad92770daf%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D300x250%26hb_pb%3D0.00%26hb_creative%3D77221793%26hb_adid%3D76b7fad92770daf%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.00&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&sc=1&cookie_enabled=1&abxe=1&dt=1652202015430&lmt=1652202015&dlt=1652202013272&idt=1598&biw=1600&bih=1200&adxs=436%2C1091%2C276%2C1091&adys=474%2C666%2C1127%2C950&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1182x1412%7C300x952%7C862x1020%7C300x952&msz=1182x90%7C300x250%7C862x250%7C300x600&fws=516%2C0%2C0%2C0&ohw=1182%2C0%2C0%2C0&ga_vid=1384813163.1652202015&ga_sid=1652202015&ga_hid=1172567&ga_fc=false&btvi=0%7C0%7C0%7C0&topics=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c759d85a0ffe1fe2f76ca0d89bd2dd963d5f23ded46a7038e2c566a998876d51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26225
x-xss-protection: 0
google-lineitem-id: 5650535185,5320060794,5320060794,5324395187
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138344350498,138305848162,138305491763,138305874849
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
11 KB 139ms
49ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022050501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25a481414b1caa166dda4486f61096c4e749b0bdc22ee9bca75b1f0ec81fe4dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10422
x-xss-protection: 0

GET
H2 200 container.html Show response
3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F8FA 6 KB
4 KB 166ms
43ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 10 May 2022 17:00:15 GMT
expires: Wed, 10 May 2023 17:00:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 219ms
134ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 May 2022 17:00:15 GMT

GET
H3 200 container.html Show response
3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CB21 6 KB
3 KB 124ms
42ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 10 May 2022 17:00:15 GMT
expires: Wed, 10 May 2023 17:00:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame E007 6 KB
3 KB 120ms
40ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 10 May 2022 17:00:15 GMT
expires: Wed, 10 May 2023 17:00:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B819 0
0 70ms
70ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu_JutbuvzewYLaN49lga_WbR6rGppDKkN3s-wCGkTu6Rlq5WbTEegEpnAajdXREAOKK-DWbypEUzX6pO0CrSdDXVy82QI7ux5UQ4DdShKQRGahXsf4GlxkMA721o9XUIJOCtv-al14BkKCV6NxEippu-iMH8Gtdpc_6rAVE2-B0QIPWHmW_YRXhSvKrFdNNrwFv_B7-rsZ9RFBdUUesZl_zmGM4cuI1WX_9PUAsk4KRCHqsLgJfNjBhH4RAHE0q5NMm_gL8p8ZnswdbN9Q3IfZnuE2ow34pd0fXf8q7XY88fgpdbug0SJzz8sdGRBWaz0-4cVRAlpXnG2hhNM&sai=AMfl-YQ-h_nGf3Gx8BQloMMu_aVIadYaEBGAA4JA_NfvS-U_6XOCeDRjAxB5I5W27DXfDuINGXl_FcfSVrxySVSv9Y1XLD1Yu2h7EoNwWKN1vVxokMoVWf2DMBmC_nUmOB0&sig=Cg0ArKJSzP6FWSPxUBywEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222514356/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 10 May 2022 17:00:15 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame B819 26 KB
10 KB 100ms
63ms Script
application/javascript 2606:4700::6810:5714
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222514356/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
fastly-original-body-size: 8874
age: 27398
x-jsd-version: 1.13.0
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19137-FRA, cache-hhn4062-HHN
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rm0cfdex%2B4JQIsEvFCQ5nh0PyB1oHAQIpJYheR77%2FT0d3m9kj8QU5eBUt8P2TC3qAXC9tQaEpgoh4Jm2z6Odt%2FUO1L1Z7nhIf75j%2BzuIZA4P5YPY4DK8SGbW70%2FuprAs1kRFNYmEdBVkICZIMhk%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 70943ae629d69158-FRA

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B819 120 KB
37 KB 128ms
49ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfaf60508a77b732490cebbf93a415622f5d33fc0a63f88365807b71a21c25b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652096384767712"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 May 2022 17:00:15 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EA4A 0
0 68ms
67ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuPjLl03_FvnU_bqCtukAMAqE8sRk7QEXwbuM2gtwrs5ZJ2-RS5Cny_lka0mXIA1Ma6jUPRQv_0ob8smc_kyL1lUahrz0VBksh_ThQeazmzw7B87_gcBrSycgqi-dOQJsCdmtSEE5BoH_8bh8HzKZTDu6LmGWkGB-SrK3FoJY9ug9BogqJQiEoFdqaCk-kIP_kk1uHDB2i9gIGkiO2nNOupMQVgt_CYKyWGRUzOAvbt65r308mYfG0N8Ad3GGhz4GhAUrQFNnc7j0VL1BhIr-k_0FlymNoF6WN3mX_iwL495_gyj--G7KKapSkWrsIYVekp1BVyld-pgV_ttX7zyw&sai=AMfl-YRyVsw-l0SdYyJJj-f3yjiFbvGfBkHvP6BOV-bCqJly7eh-bq9Sb_h_vmO2luqJPXdk2I6WJe8_6xzNPhE-xi8pGVDo73AwXjzLKs0x89p1OrTvQU3Rzc9ocYSUsR8&sig=Cg0ArKJSzMWDtPV4JgtTEAE&uach_m=[UACH]&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222514356/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 10 May 2022 17:00:15 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220505/r20110914/ Frame EA4A 19 KB
8 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220505/r20110914/abg_lite_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b83149463619a5f4bbee21909e8a99a085f15713e48d6522d0a3173b94a20e1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:52:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 495
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8007
x-xss-protection: 0
server: cafe
etag: 8765308293129799388
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:52:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220505/r20110914/client/ Frame EA4A 3 KB
1 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220505/r20110914/client/window_focus_fy2019.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:53:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 430
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:53:05 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EA4A 120 KB
37 KB 139ms
68ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfaf60508a77b732490cebbf93a415622f5d33fc0a63f88365807b71a21c25b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652096384767712"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 May 2022 17:00:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame EA4A 0
0 131ms
44ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSu-uK-2ipCJLIRxQD-9ISuzi1tG-IhzPxzvEv0JUIZstIx_KYYhGMe4drqi3GF2TII3tpKvy7aRc2ba8N5A5eAuBOMlw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H2 200 9435140927320421974
tpc.googlesyndication.com/simgad/ Frame EA4A 92 KB
92 KB 45ms
44ms Image
image/jpeg 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9435140927320421974

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de8279221cec92147e41e962754da2e9667fe862dc94f192566fa7bec3d11f11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 12:00:28 GMT
x-content-type-options: nosniff
age: 17987
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93765
x-xss-protection: 0
last-modified: Tue, 10 Mar 2020 20:30:38 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 10 May 2023 12:00:28 GMT

GET
H/1.1 200
OK script.js Show response
acdn.adnxs-simple.com/strikeforce/ Frame 665C 114 KB
40 KB 166ms
7ms Script
application/javascript 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 45306671a9b3d4d1a3a96aecc974d4df0ad542531ee13be0d5a402f88a154430

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:15 GMT
Content-Encoding: gzip
Last-Modified: Wed, 27 Apr 2022 16:09:57 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "62696ad5-1c6ab"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Length: 40446
Expires: Wed, 11 May 2022 17:00:17 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 665C 0
20 B 144ms
70ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-C8C9I04iAPpVMOCJpKVy_zMlE_m2NoDwtzEFbuR8JGQxn6onFCADMInt3AifY_Rucy_eAlsDi03_l5GBVpEeMGMxq9KQ

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 665C 11 KB
5 KB 196ms
37ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b44a4b2aac311fbc8c7003fe8401d53ed6b3c68a2f88fa522c5d92b25fdb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:50:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 589
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4881
x-xss-protection: 0
server: cafe
etag: 17592260700507526713
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 10 May 2022 17:50:26 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 665C 85 KB
29 KB 156ms
7ms Script
application/x-javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:15 GMT
Content-Encoding: gzip
Age: 6508904
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29216
X-Served-By: cache-lga21974-LGA, cache-hhn4062-HHN
Access-Control-Allow-Origin: *, *
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
X-Timer: S1652202016.934892,VS0,VE0
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 24 Feb 2023 08:58:29 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 386514, 3463713

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 665C 0
819 B 211ms
53ms Image
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwheregoes.com%252Ftrace%252F20222514356%252F&e=wqT_3QKLBsgLAwAAAwDWAAUBCJ-06pMGEKGxg8rvjYqsfhgAKjYJ8lt0stR6nz8RwnzDjhAvmT8ZAAABAgzoPyHCDRIAKREkyDEAAADgUbiePzD17bMLOMpBQOUeSGVQp6LLJViY1VJgAGjP-Gt4iugFgAEBigEDVVNEkgUG9BMCmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCAOACn_A_6gIoaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjIyNTE0MzU2L4ADAIgDAZADAJgDF6ADAaoD6gEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmF3YmlkX2I9QUtBbWYtQ00yMHBVMTh6S3cwMUN4ODktV1pHMlZGUEFmRkZBWFFfSVZZbV9xN0s2NktIampWbzNfc1dNcWJiVmNHRmlsZVpUdTRmd2RIZ0JDb0J3UHVuMkVId3lWVEM0QUEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTOTEwNDA3MTEwMzgyMjc0NzgwOSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDzE4NS4yMTMuMTU1LjE2MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8ASnossliAUBmAUAoAX16q2TlanCiDvABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXMkCX6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAEFkGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTA2MTU3MTkyNzk2ugcPCAABKUQgADAAOLoGQADIB4roBdIHDQkRSQEeCNoHBgknROAHAOoHAggA8Afs-wOKCAIQAA..&s=d204a1774671768e7a970ea5d619bd4f233bcfe2

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:15 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9159bdf2-5748-483e-853f-99525213af84
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame E007 22 KB
7 KB 191ms
47ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 08:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30495
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 10 May 2023 08:32:00 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame E007 8 KB
4 KB 159ms
14ms Script
application/javascript 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=324522425&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssNrDuy3ORt4XPp2vF5omIKdva7-tRMjWNw_1ktUeAov2JAn0M8WnjMAlwSWMcOvnvwlVlNXJoGP5NVgWK8SobU55sLWQI7CVLwn-TqHlmLM6eTDVHCks2QRzDn2bANEeHtRFL1NWiGXtLbkBUHORNECcQNyB5Pz-Nv3RzX4d1jLp9AU272sd-l1IChV93smJy8XZrlDjwq70uKC1BAHCTRY6aqpWIwzlIV9frVtZGcm3S9U7mCKT6pc1KMa_XNWudy38sAZsu6DoOXGJkg4IGeMK84TFFDRXH0L7nZ2TVRgzZm1V1Jg7OuLGEMXl9kkgR-DE84XNYVC-a0b6edMEingg%2526sai%253DAMfl-YQsB3PmL__RNSsN9p-DDLac6bPjmsHdmnQuN57bdkciH6L-eKi73ldRYmy_gNz8GCN5kdPHEcErS687rkbDIwCA1LF0zlSZ-wyyYcbF_blsCO74teRtQ1qOmNOFCG0%2526sig%253DCg0ArKJSzEoQSuM5vYOKEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

7974e98cc2dbf3ccda36690d8a32299d3793bbfe2955d7891d2b3541d7bb70e8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:15 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 0011086e-4985-4b25-b6a5-8cfb6d99938d
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E007 120 KB
37 KB 66ms
65ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfaf60508a77b732490cebbf93a415622f5d33fc0a63f88365807b71a21c25b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652096384767712"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 May 2022 17:00:15 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame CB21 22 KB
7 KB 152ms
39ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 08:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30495
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 10 May 2023 08:32:00 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame CB21 8 KB
4 KB 144ms
31ms Script
application/javascript 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=630963215&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssZ0XdWgsyj9dR3iMeufgUhpuzWloOEMmSca9ZXHBZodkflS10bG07fTi-S75qg2y2Bn1iKnCUXzTap7Hgb7ZDrtwgR16GD4TwQYZqhZujfDyYYOCaeg2avy-v9Mdybc0mYC7vWzuVsVgtqae6b97fNynPdAEJ3LCC9UTGfu0sj0XnAEfzMKPHyj1om8JxsERDz2yjhz8MTw3J0eDs6xD7Txm07D705VaoMlJ4Nh4hoHSu7-tFjwAjI1Ii7AKhb-94eyGLXbRp17HYzEC6FBuvq-ED2u_TUrA8vfua6Z-9yGtwkp1VHDCc9Fyt9atL7jBkgLOwz%2526sai%253DAMfl-YTyEJwHt_Nj_Fs7QPRaeC6Fds2QhyefUosean5QQmALEOTpTAGCn5CMoq4iZVJTP07MZV_R4Z5y-dP3tBzYd__ZPlDEh0cNeowd7zC5N2IIqB0LTCi9nFaRal_ZfWQ%2526sig%253DCg0ArKJSzBrKzzh_y7HFEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

eeeff862a3bdefaba1040395ff3c4fbc3a8f0eea1bdb17c65a16a1a92a4cf700

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:15 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: c6967ee6-4ec7-4456-b291-09482c1f77e5
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CB21 120 KB
37 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfaf60508a77b732490cebbf93a415622f5d33fc0a63f88365807b71a21c25b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652096384767712"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 May 2022 17:00:15 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8549 13 KB
5 KB 52ms
41ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 468
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 10 May 2022 16:52:27 GMT
expires: Wed, 10 May 2023 16:52:27 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 327F 783 B
534 B 132ms
49ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f22be66c6691b8a95e3e0e53e07b8cb97427fa54d4e51811370130be6c0eef3d

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-zfScW+KoGukQ0iwUfdo0+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-zfScW+KoGukQ0iwUfdo0+Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 10 May 2022 17:00:16 GMT
expires: Tue, 10 May 2022 17:00:16 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ Frame B819 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49231d713dab444c8af5f463a394705fac17d2c4a4e91d176f957cfdbac92a5e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame EA4A 0
0 138ms
68ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstTUxB9Gapf6k5c1vZpgVBq3zGST8WHMfyQhxhN4sdAgnAyVsfn_sU2uPSoQ1_G_o7VxfATQWh2oM6qbtC-53GTRPzvP0822M8lY0zjbhAQPWbFkmcTdxBfdz1TphDFiD83X4sZUWumjfs8Uk8Joaxk19aKLjKajxNMVUI1jk5WyytbLWaKLwyTZlNC3dfDrukBz6TwnKxzH0NtbBkFV0QkQx62uQY1oeXWMqx4B7fb0dBZDvb9-SO4U79K04nBCRNVpCBk38hnzQ-1pinkUnqyzAktWT7B8zsMnbcebW_G0ulBYJFHLoWtaWfX4EQMPdgsBt-JCKG-8DIlbyu8Ai70&sai=AMfl-YRnrgWdagidIKBJaU2zLPW-zp32taCCQSymfoTW1z2n8mqro9g82570EW7Ojy-HtU6yU7IfMcpXaN8QyJVZowoEjebV1SJSUbpksEH1wfDhwGzIlfy1Yhl7FkSBeXQ&sig=Cg0ArKJSzCHM6cCg-DV-EAE&uach_m=[UACH]&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:15 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 10 May 2022 17:00:15 GMT

GET
DATA 200
OK truncated
/ Frame EA4A 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7301125e7e5697b6264e3102d095a4280da1c2a3f75a8c4b37f9fc0742191e35

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 204 1a
i.clean.gg/ Frame 0
0 193ms
119ms Preflight
text/plain 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://wheregoes.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain; charset=utf-8
date: Tue, 10 May 2022 17:00:16 GMT
server: nginx/1.21.6
via: 1.1 google

POST
H3 200 1a Show response
i.clean.gg/ Frame 665C 0
15 B 182ms
119ms XHR
application/octet-stream 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 10 May 2022 17:00:16 GMT
via: 1.1 google
server: nginx/1.21.6
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 0A64 13 KB
5 KB 38ms
37ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222514356/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76085
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 09 May 2022 19:52:10 GMT
etag: 12223946614886178233
expires: Tue, 10 May 2022 19:52:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK rd_log Show response
ams1-ib.adnxs.com/ Frame 665C 0
819 B 18ms
16ms Script
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&e=wqT_3QL9MMh9GAAAAwDWAAUBCJ-06pMGEKGxg8rvjYqsfhgAKjYJ8lt0stR6nz8RwnzDjhAvmT8ZAAABAgzoPyHCDRIAKREkyDEAAADgUbiePzD17bMLOMpBQOUeSGVQp6LLJViY1VJgAGjP-Gt4iugFgAEBigEDVVNEkgUG9F4BmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCAOACn_A_6gIoaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjIyNTE0MzU2L_ICDAoGSEVJR0hUEgI5MPICDAoFV0lEVEgSAzcyOPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICGAoKSUZSQU1FX0tFWRIKMTM0NzQ0MTYyMPICvxUKC1BSRV9TQ1JJUFRTEq8VPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmO3ZhciBrPUFycmF5LnByb3RvdHlwZS5pbmRleE9mP2Z1DY48YSxjKXtyZXR1cm4gQXJyYUotABAuY2FsbAEpLCx2b2lkIDApfTpmdS4_AFhpZigic3RyaW5nIj09PXR5cGVvZiBhKQlWERoAIRUaSGN8fDEhPWMubGVuZ3RoPy0xOmERmCQoYywwKTtmb3IoAb8YZD0wO2Q8YQ0pXDtkKyspaWYoZCBpbiBhJiZhW2RdPT09Yw1oCCBkOwlxHC0xfTsvKgoKnjoBEcw4IGwoYSl7bFsiICJdKGEpDU4IIGF9CRMAPREoECgpe307EQ0EIG4BNQRhPSkaOD09PWE_ZG9jdW1lbnQ6YRVDJC5jcmVhdGVFbGUBGRgoImltZyIpHUUAcCVecGQpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7ISwUYj1uKGEuEXwEKTshKQQpewEaAGUuugAZFwRmPVpTADwsZz1rKGYsYik7MDw9ZyYmPhYCFHNwbGljZUkVdGYsZywxKX1iLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGUsITEpO1IjAGI6ABBlcnJvcg07GH07Yi5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAHGIuc3JjPWM7WjEBGC5wdXNoKGIu0QEEcSgpfARhPTGSNC5jdXJyZW50U2NyaXB0TRoAKDI5AixudWxsOmEpJiYiNzdhSWxhLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RR3wRnI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7eSsAdBXgAGgFYQxjPVtdBQkEZD0Bxgw7ZG97QXsYYj1hO3RyeQUMAGVBkxhlPSEhYiYmASRQIT1iLmxvY2F0aW9uLmhyZWYpYjp7AS2QbChiLmZvbyk7ZT0hMDticmVhayBifWNhdGNoKG0pe31lPSExfQFeCGY9ZRkXAGYBFgxpZihmKXkAZz5eAAw7ZD1idR8h9DVCJHJlZmVycmVyfHwBlyR9ZWxzZSBnPWQsDcsAYynfMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_0x9fXdoaWxlKGEmJmIhPWEpO2I9MIXVAGGV9nQtMTtiPD1hOysrYiljW2JdLmRlcHRoPWEtYjtiPWghKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHACtOAA9HXUAKaFbFGE9MTthPLGATDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaBmrIdVl5QBnJRYlAgRkPTIEARwwPD1kOy0tZKHYSGY9Y1tkXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZBXmBCYmAcwBOwQ7MEFlJVoIJiZkBUgBGwgpO2MFrRB2KGIsZ7XoFGMuZz9jLgX6DDpjLmkBQAB9teYAdqGhHCl7dGhpcy5pQdUBCQhnPWMZIgB1HSIIdXJsESQUaD0hIWM7BS8FiCUKvfoAd3VJFHQoKSxjPfkKPCI_Iik7c2V0VGltZW91dCgRjA0xAGTZcxhkPy4wMTpkQTVEIShNYXRoLnJhbmRvbSgpPmQpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzZ0Qc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGU9KGUBsQwpJiZlWpkADTEwIil8fCJ1bmtub3duImHjXCtlKyImc2FtcGxlPSIrZDtiPXdpbmRvdwVYAGY5NBRmPyExOmYhMzRlPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGU9L0Nocm9tZS9JmyBlKSYmIS9FZGcZERw_ITA6ITE7ZWGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGQpOnAoYixkLCJFCAmeCCl9fQ4OCRbWCCggMDw9Yz9hLnN1YhZrCRwoMCxjKTphfQngDC5yZmwu6AcNNWhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnpwUGaFCk7Cjwvc8WYbD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFLVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwhl9iPUFLQW1mLUM4QzlJMDRpQVBwVk1PQ0pwS1Z5X3pNbEVfbTJOb0R3dHpFRmJ1UjhKR1F4bjZvbkZDQURNSW50M0FpZllfUnVjeV9lQWxzRGkwM19sNUdCVnBFZU1HTXhxOUtRIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIjEafGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKaAQoMUE9TVF9TGhEMCIkBPClqNggBFvYJUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZQlLAD4NUwA-nSQoIHtyM3B4KCcxMzQanQwcJyk7fSkoKTs96xDOEgoQSAGeNFBPUlRfUEFSQU1TErkSkSSKlQDwfWFkZmV0Y2g_YWRrPTE4MzI0OTQxMTMmYWRzYWZlPW1lZGl1bSZjbGllbnQ9Y2EtcHViLTMwNzY4OTAwMTI3NDE0NjcmZm9ybWF0PTcyOHg5MF9hcyZpcD0xODUuMjEzLjE1NS4xNjImb3V0cHV0PWh0bWwmdW52aWV3ZWRfcE2NIF9zdGFydD0xJqF4Eb1-CQ4QJnN1Yl8NmgBiQaHwfXItMzA1NjQ0NyZobD1kZSZhY2VpZD1NSFlYdEFDc0dyUUF3QnEwQUpVYnRBQ21HN1FBLVZVMEFRNW9OQUdRYWpRQnlHdzBBWVZ5TkFGWWN6UUJLSFUwQVV0MU5BR0NkalFCN25ZMEFRTjNOQUZUZHpRQmZIYzBBYngzTkFIQQEQLDEzYzBBZTEzTkFINgEQRERuZzBBUko0TkFFVWVEUUJIWAEQADUBEABoARD02AhTM05CQVZOelFRRTVfTmtCcndYYUFXQWNYQUxBSFZ3Q1ZSNWNBbDBlWEFMVzlvZ0NKMEtxQWloQ3FnSXBRcW9DaEVPcUF2QldxZ0xfZjZvQ25vaXFBbzJLcWdLQW02b0NnWnVxQW9LYnFnTDBuYW9Db3FpcUFsT3NxZ0xPeDZvQ2ZNMnFBbkRQcWdMZTBxb0NmTjJxQWxYZXFnS180S29Db09XcUFnX3BxZ0w4N0tvQ3V1LXFBdGZ4cWdKTzhxb0NzUE9xQW96MHFnTHo5YW9DOVBlcUFnMzRxZ0pzLUtvQzR2bXFBaWI3cWdKQi02b0NCdnlxQWlqOHFnSjJfS29DLWYycUFnMy1xZ0pnX3FvQ2xfLXFBaThBcXdKTEFhc0NRd0tyQXVvQ3F3THNBcXNDOHdLckFoUURxd0tXQTZzQzZ3U3JBallGcXdKZkJhc0NJd2FyQXRBR3F3TFVCcXNDNEFhckF2TUdxd0llQjZzQ3NRZXJBc0FIcXdJQ0Nhc0N5Z21yQWg4S3F3S2JzOFVGZHdmNUNNNmhOUkhvOTM0U0NxajdFam5ELXhMOHhfc1NMOG43RWw3VC14SzIxdnNTZnRuN0VycmMteEl6NHZzU2stYjdFczduLXhKXzZ2c1NiLTM3RW5MdC14SkI3dnNTN2ZQN0VnVDAteEpLOWZzU25QWDdFdjcxLXhLajlfc1M5ZmY3RWhmNC14SUMtZnNTT2ZuN0VuTTRveGozVm1zYTZGekxKckR3V1Nod1ppSkkmZXhrPTEzNDc0NDE2MjAmYXdiaWRfYz1BS0FtZi1DeVRJempFZmd0ZTV2a3Y1NWJ4NUU3ekpJaklzR0IydU5fMmRrSmc3Y0MxVmxpbG54em4zQnc1SkZWLVROcC1ORzlIdDhadllZRVBXUERaTHZrc2NlX2Zpc1F3T0RLellyNzlIQ01kbnJ2RjJzRFBuakIxb2hGeFMyajMyRTNBSE1lSEg1elN3TnEyRVoxWDB4alc0NmRaMHhXMFB2OFBrZEFsQXBCRHBaUVJ5UVcyNzQmYXdiaWRfZD1BS0FtZi1Eb0FQMk0ycm91VGkzWDJKQ21ZWEJ0c3ZtbFhMdERlQXVZNlVPZllmUm00bXdrZFEyTjJoR3pjVkhHbWdIc1lQMms2bDVrODVkR20tY291Q2JsaUdneHMtVDd1SkJjNkwybmlvZEppMTBVRWpWbjVvbmpXQjFMVC16SUMyamszZzI2NGFiR2kxUVg5MC1qblhzZ1VmYVZBNFFlNGpvUnkzMkxQOEZjMWJFTk5NRDF6bWg2cHk5MWt3VzFlYjF5ZDJzRHA3bVV5MHV3eGVhcFF1bnJTTVFMZTJfemh4LXA5VmFDemdqeUZydWZrVFJfUE84amZhRjVSR2ZhRUNlZGdaYVBhdVRKMmcyTHNHN2thX0cyU3BuY0RNSy1DTVU4NzdhWXBSTlpKS2YxeUN6Y296UzJRQXVpRGlPTjRmbTRwQTFpUlpiWGh3Z1ZqVzZHcmY2dmJkSmFXOTYxX0dYX3NTelhQUnFrWkM2dnY1UE5Nd05tbVZubmZEOHhJaFBYMGVBM3FJNERVTC1yUXg4X3ltTWw1MGp4cnB1N1pZblRpRDVpUGphcUx0S05kR2w2ODRZWXZiVWZaMXZvSC1pcUNGSDJiQy1RdkFUbklYU1N4OE9uaDRNU1oyX0pOaWxnbkpwekNESVV6bFp6bnlJSG82aUNNUW5kR3FtRUttX0c2d1Zwci1PU3hVTUF1ZkpzUzlzWUNWNkxBRWFURkFhdnhjZHY4MlRXd2pRRnlTQWFLNnlwRU80bGV1YV91ODhYX3p6YzB2dHVtMXZkNGFiZ2V6M0ZhZnhjWGlzN3hIMVk5U3NYUUdaUTIwSGVWZkhLd2R6NGFXdHdOVUtockp4dEtuLWFzcWpRZGlSVTVVOVo2UENCWjBzemt3OXpzTTlsWGRsQ09GSU01Y3ZseW9jRFhVdVJjVm0yeHNLSlhGREQxektvZktLcVpqbmVmbUp0d3NocUNDblZjNnZGSGFZTXZlWVh6NGd2YmhJQWhmdzVhSnVhMEFwdjEwU3R2VGh0ckstRlRXckp1M3BYZ2wzY3JJaFg2N0VuYWZPOU0tbnBQM2hxVk1qOGVVMlc3cm1YMm5FbzlOTUVySm55THI3QVRncmpCYUZqcDJkVmI5alM2TW9tSDFaZWpQUlkwcTBFNzRJMktMNUh3dEJqMkNSREsweHkyaHBwdjYtOFVyVE1Ib0hRVmxWczkyLXpqcHZnNU1UZ09PYXRUcldGbjRXaENZR3Z5b3U4cENHNTR1bmpIT1BNVUo0RTlpNjB5NllfZ1UyVGoyRExYOGtwVjNoRzZvb0dKTDllZjJUQlR0Y1JWYlhfV3NFSm9tMWszbFBpT0JuWHRzZVcyLVozSXN2dERONl9PS2UxbkZZUE1JZ3lBdlBhZ2ZaNmFMdzR3czZyUFBUd1NaZ2NCSzB2b0hMLUxwOWJlbmgzOTU4V21zM0twNlRuYmdhTlN5VFBiQjRzajU1NU9xUFZwVW9oYlEmY2lkPUNBQVNCT1JvQldBJmFfY2lkPYADAIgDAZADAJgDF6ADAaoDAMADrALIAwDYAwDgAwDoAwD4AwGABACSBA0vdXQvdjMvcHJlYmlkmAQAogQPMTg1LjIxMy4xNTUuMTYyqAQAsgQPCAAQARjYBSBaKAAwADgCuAQAwAQAyAQA2gQCCAHgBAHwBKeiyyWIBQGYBQCgBfXqrZOVqcKIO8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBcyQJfoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMDYxNTcxOTI3OTa6Bw8IABAAGAAgADAAOLoGQADIB4roBdIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAH7PsDiggCEAA.&s=4ecbccf13717fd7c0b511ff7dbbe3e5bbac7b98f&bdref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2a198267-791f-4d12-adab-dfe3fb200ed2
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CB21 0
0 70ms
69ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv3uOCuVeOSLjmRQlnMnDt9E7QduCNAb-0UZb5pxE8ZwuXTqeyAC47AD3Sy35FbHDhUCAhe93eKfMUP35DWpyjkUhTNIJdi9C4dnHl3EsUqqA0PFL9HEAbMAHbGqlmK7rnSdPf5HGqSllEwA9J08a45sCGGzRNX6ZaeFhA28OYDgz6i6WDcGB656NJk8yLzxQzpyrzXYOVIVi5YFHInTEyOxt4JohwbVblQbGozzs1oNcWjhIoWpFJ8m8swWGxXJnA_CvLXuGSluDwQvd-EhZhjnMwUR2MNuzOIIw0UTgflWLYe03a9N1qEAqnIBu0PX3qr7RzG8WrI&sai=AMfl-YRVSsp8Tp_K6Q9MgTcu_ZKc_m0dU44BQfrbAbLuX-bqaXBCFW6S5Jhvo3WHHusLhRfV_kkB8Oah9tO_YcIM-WD_p6q3pbAyNPsuqsLYlxG6Mc3cL6iZQ8bpSQLe1ow&sig=Cg0ArKJSzLpaA0Ec3BshEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sync Show response
gum.criteo.com/ Frame CB21 51 B
377 B 341ms
15ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=630963215&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssZ0XdWgsyj9dR3iMeufgUhpuzWloOEMmSca9ZXHBZodkflS10bG07fTi-S75qg2y2Bn1iKnCUXzTap7Hgb7ZDrtwgR16GD4TwQYZqhZujfDyYYOCaeg2avy-v9Mdybc0mYC7vWzuVsVgtqae6b97fNynPdAEJ3LCC9UTGfu0sj0XnAEfzMKPHyj1om8JxsERDz2yjhz8MTw3J0eDs6xD7Txm07D705VaoMlJ4Nh4hoHSu7-tFjwAjI1Ii7AKhb-94eyGLXbRp17HYzEC6FBuvq-ED2u_TUrA8vfua6Z-9yGtwkp1VHDCc9Fyt9atL7jBkgLOwz%2526sai%253DAMfl-YTyEJwHt_Nj_Fs7QPRaeC6Fds2QhyefUosean5QQmALEOTpTAGCn5CMoq4iZVJTP07MZV_R4Z5y-dP3tBzYd__ZPlDEh0cNeowd7zC5N2IIqB0LTCi9nFaRal_ZfWQ%2526sig%253DCg0ArKJSzBrKzzh_y7HFEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:15 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1534
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame CB21 8 KB
7 KB 199ms
199ms Script
application/javascript 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1652202015&bdh=VWeXh0Xtj096MZbFe0CPCe0PlYk.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=630963215&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssZ0XdWgsyj9dR3iMeufgUhpuzWloOEMmSca9ZXHBZodkflS10bG07fTi-S75qg2y2Bn1iKnCUXzTap7Hgb7ZDrtwgR16GD4TwQYZqhZujfDyYYOCaeg2avy-v9Mdybc0mYC7vWzuVsVgtqae6b97fNynPdAEJ3LCC9UTGfu0sj0XnAEfzMKPHyj1om8JxsERDz2yjhz8MTw3J0eDs6xD7Txm07D705VaoMlJ4Nh4hoHSu7-tFjwAjI1Ii7AKhb-94eyGLXbRp17HYzEC6FBuvq-ED2u_TUrA8vfua6Z-9yGtwkp1VHDCc9Fyt9atL7jBkgLOwz%2526sai%253DAMfl-YTyEJwHt_Nj_Fs7QPRaeC6Fds2QhyefUosean5QQmALEOTpTAGCn5CMoq4iZVJTP07MZV_R4Z5y-dP3tBzYd__ZPlDEh0cNeowd7zC5N2IIqB0LTCi9nFaRal_ZfWQ%2526sig%253DCg0ArKJSzBrKzzh_y7HFEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e023379d15c334465ad1c70e6d2d9d085e8855b673c78cc95955d822f294ba86

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:16 GMT
Content-Encoding: gzip
X-Creative-ID: 77221793
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: b3001386-e188-4de6-b4de-718e524904f9
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E007 0
0 67ms
67ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv0ipQgjfZCcFoKadm1u5yF_r6pY0XrHJBNArbQeLAPKGX_nr0UL6bXHbbSKxOAFPOoIBU-z1EtO2pilVyYJI4YDegCCAIXHl_O8A1hGjZQO1ZLUpLBtlVOZadA40zWp0zMiPlzeNJr_hlp-gc-vnL1_FLh73k3jeWPObNVHWFbfD8Gg5f1nZgK_3_IV88Sb_qXIi2cBMK8_yrJf-KHJ0tRF27i_WtkhJjmmsmmIQj7XdZmnL904JS7PzgEDtLHggJMuq-WQqMmK5hT21PXv1spi-SKvx4a8Hi_7SACXpt7fTenosPmXHKE2A9gU7hWAtjPTjxpdohLqFZmB3a2cRVbvFT1MA&sai=AMfl-YQDrh90ClYQf6iHvuxaywetDu99RKTG5vRx0dZjTsGh53tb8w4_nWcfCHGJ6gXrFnddmPJBF-leuLf_EUIYH-Uv0mzvX2L1CDow8UTnKRZHybIM6YVwqCD1ql2O_6c&sig=Cg0ArKJSzE78QJDsbbrGEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sync Show response
gum.criteo.com/ Frame E007 51 B
376 B 337ms
15ms Script
text/javascript 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=324522425&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjssNrDuy3ORt4XPp2vF5omIKdva7-tRMjWNw_1ktUeAov2JAn0M8WnjMAlwSWMcOvnvwlVlNXJoGP5NVgWK8SobU55sLWQI7CVLwn-TqHlmLM6eTDVHCks2QRzDn2bANEeHtRFL1NWiGXtLbkBUHORNECcQNyB5Pz-Nv3RzX4d1jLp9AU272sd-l1IChV93smJy8XZrlDjwq70uKC1BAHCTRY6aqpWIwzlIV9frVtZGcm3S9U7mCKT6pc1KMa_XNWudy38sAZsu6DoOXGJkg4IGeMK84TFFDRXH0L7nZ2TVRgzZm1V1Jg7OuLGEMXl9kkgR-DE84XNYVC-a0b6edMEingg%2526sai%253DAMfl-YQsB3PmL__RNSsN9p-DDLac6bPjmsHdmnQuN57bdkciH6L-eKi73ldRYmy_gNz8GCN5kdPHEcErS687rkbDIwCA1LF0zlSZ-wyyYcbF_blsCO74teRtQ1qOmNOFCG0%2526sig%253DCg0ArKJSzEoQSuM5vYOKEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:16 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1529
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame E007 6 KB
4 KB 277ms
277ms Script
application/javascript 185.33.220.243
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1652202015&bdh=VWeXh0Xtj096MZbFe0CPCe0PlYk.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=324522425&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssNrDuy3ORt4XPp2vF5omIKdva7-tRMjWNw_1ktUeAov2JAn0M8WnjMAlwSWMcOvnvwlVlNXJoGP5NVgWK8SobU55sLWQI7CVLwn-TqHlmLM6eTDVHCks2QRzDn2bANEeHtRFL1NWiGXtLbkBUHORNECcQNyB5Pz-Nv3RzX4d1jLp9AU272sd-l1IChV93smJy8XZrlDjwq70uKC1BAHCTRY6aqpWIwzlIV9frVtZGcm3S9U7mCKT6pc1KMa_XNWudy38sAZsu6DoOXGJkg4IGeMK84TFFDRXH0L7nZ2TVRgzZm1V1Jg7OuLGEMXl9kkgR-DE84XNYVC-a0b6edMEingg%2526sai%253DAMfl-YQsB3PmL__RNSsN9p-DDLac6bPjmsHdmnQuN57bdkciH6L-eKi73ldRYmy_gNz8GCN5kdPHEcErS687rkbDIwCA1LF0zlSZ-wyyYcbF_blsCO74teRtQ1qOmNOFCG0%2526sig%253DCg0ArKJSzEoQSuM5vYOKEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.243 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b7195bf38804575e103966fb117eaf6ac132cdc1e24d63f40086835372e622e5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:16 GMT
Content-Encoding: gzip
X-Creative-ID: 357934244
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1c033c49-f689-4bd6-98dc-21b4ec0b3de1
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 665C 0
839 B 15ms
15ms Ping
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&e=wqT_3QKLBsgLAwAAAwDWAAUBCJ-06pMGEKGxg8rvjYqsfhgAKjYJ8lt0stR6nz8RwnzDjhAvmT8ZAAABAgzoPyHCDRIAKREkyDEAAADgUbiePzD17bMLOMpBQOUeSGVQp6LLJViY1VJgAGjP-Gt4iugFgAEBigEDVVNEkgUG9BMCmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCAOACn_A_6gIoaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjIyNTE0MzU2L4ADAIgDAZADAJgDF6ADAaoD6gEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmF3YmlkX2I9QUtBbWYtQ00yMHBVMTh6S3cwMUN4ODktV1pHMlZGUEFmRkZBWFFfSVZZbV9xN0s2NktIampWbzNfc1dNcWJiVmNHRmlsZVpUdTRmd2RIZ0JDb0J3UHVuMkVId3lWVEM0QUEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTOTEwNDA3MTEwMzgyMjc0NzgwOSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDzE4NS4yMTMuMTU1LjE2MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8ASnossliAUBmAUAoAX16q2TlanCiDvABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXMkCX6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAEFkGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTA2MTU3MTkyNzk2ugcPCAABKUQgADAAOLoGQADIB4roBdIHDQkRSQEeCNoHBgknROAHAOoHAggA8Afs-wOKCAIQAA..&s=d204a1774671768e7a970ea5d619bd4f233bcfe2&type=nv&nvt=5&jm=1003&px=436&py=474&bw=728&bh=90&sid=1722182681031183046&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&sw=1600&sh=1200&pw=1600&ph=2226&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a495acdc-4531-4564-808e-ff7cad8cc82d
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame B819 0
0 72ms
72ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsusr0JyYEjo41OX5enLmBsN-SafqpOMzPloUSQsh87UGu5eMLKkjX0-02U4wMQpYmd99eanA7Bvq5xHT5wpV_63H1Dz3J7-4skf5UlVAOaBDXp2QBo4ZHn-QPRYMrqHIANo-vWwhWYXn5Z-ppqZ9ZkmNQV1hePdy6UFBHebd_2sVGQ_ZKo7FJEIg39x_3tcXVMYKXZMQ2EUCwgV4N5SQqjYKtkLQVC1xLtuqFR0QzruaT11yEK6vxcJB5ar7ftgyviYRqgIagpQ8LSQAa7Us9Pwhdal5P6IIIxiZML0Ks-B_q0wT_0zMu017TW7Z6T0ISzNgGfYQbAHnwt4fbEfPw&sai=AMfl-YTL83XojRWVc3wJqdhIY3xwiDXug2vumei6Ac4JkExfo9HzK-vkmiaTkPUdWSyiRAvAtE3Phxc2f2ULVpmiHkgQRey58UAj75dGOmkfUMbeg2aSxVHx6ngkuXFz5VY&sig=Cg0ArKJSzBxMYj2h3RFtEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 10 May 2022 17:00:16 GMT

GET
H3 200 6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js Show response
pagead2.googlesyndication.com/bg/ Frame 8549 35 KB
13 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea4019076476224330f3b3f4fa21af893f81abf9e80cb924911e8186167d9042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 15:57:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3753
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13523
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 10 May 2023 15:57:43 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 0A64 100 KB
34 KB 190ms
110ms XHR
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2911b58b0dfd6bda1081b4176c41ac5c58f0e10ec6e5a13c7caf4b379f44c8b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 10 May 2022 17:00:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34528
x-xss-protection: 0

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8549 0
9 B 39ms
38ms Image
text/plain 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?uFJOjg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:16 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 327F 0
0 134ms
133ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022050501&jk=4440442240957361&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H/1.1 200
OK if Show response
ams1-ib.adnxs.com/ Frame 12C2 10 KB
6 KB 53ms
52ms Document
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLANfBMwBoAAAMA1gAFAQigtOqTBhCIhsjL2riSiQEY6YKysa-ApeE9KjYJkQw5tp4hjD8RdHD6xEuBhj8ZAAAA4FG4rj8hdHD6xEuBhj8pkQwJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3NaMFhkV2dzeWo5ZFIzaU1ldWZnVWhwdXpXbG9PRU1tU2NhOVpYSEJab2RrZmxTMTBiRzA3ZlRpLVM3NXFnMnkyQm4xaUtuQ1VYelRhcDdIZ2I3WkRydHdnUjE2R0Q0VHdRWVpxaFp1amZEeVlZT0NhZWcyYXZ5LXY5TWR5YmMwbVlDN3ZXenVWc1ZndHFhZTZiOTdmTnluUGRBRUozTENDOVVUR2Z1MHNqMFhuQUVmek1LUEh5ajFvbThKeHNFUkR6MnlqaHo4TVR3M0owZURzNnhEN1R4bTA3RDcwNVZhb01sSjROaDRob0hTdTctdEZqd0FqSTFJaTdBS2hiLTk0ZXlHTFhiUnAxN0hZekVDNkZCdXZxLUVEMnVfVFVyQTh2ZnVhNlotOXlHdHdrcDFWSERDYzlGeXQ5YXRMN2pCa2dMT3d6JTI1MjZzYWklMjUzREFNZmwtWVR5RUp3SHRfTmpfRnM3UVBSYWVDNkZkczJRaHllZlVvc2VhbjVRUW1BTEVPVHBUQUdDbjVDTW9xNGlaVkpUUDA3TVpWX1I0WjV5LWRQM3RCellkX19aUGxERWgwY05lb3dkN3pDNU4ySUlxQjBMVENpOW5GYVJhbF9aZldRJTI1MjZzaWclMjUzRENnMEFyS0pTekJyS3p6aF95N0hGRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGW9MQBOi8vd2hlcmVnb2VzLmNvbS_yAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk3Nzc5Njc3MDDyAr8VCgtQUkVfU0NSSVBUUxKvFTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjt2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhDSmIO2QrKylpZihkIGluIGEmJmFbZF09PT1jKXJldHVybiBkO3IFCQwtMX07JWKaOgEAZi2ZOCBsKGEpe2xbIiAiXShhKQ1OCCBhfQkTAD0RKBAoKXt9OxENBCBuATVYYT12b2lkIDA9PT1hP2RvY3VtZW50OmEVQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FAHAhh3QsZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgA4PVtdKTt2YXIgYj1uKGEuEXwEKTshKQQpewEaAGUuugAZFwRmPVpTAFAsZz1rKGYsYik7MDw9ZyYmQXJyYXldQ6hzcGxpY2UuY2FsbChmLGcsMSl9Yi5yZW1vdmVFdmVudExpc3RlbmVyJiZiThcANCgibG9hZCIsZSwhMSk7tjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAQmJkZIAAAoNmoAHGIuc3JjPWM7WjEBGC5wdXNoKGIu0QEEcSgpfARhPTGSNC5jdXJyZW50U2NyaXB0TRoAKDI5AjBudWxsOmEpJiYiNzciQUtoLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RR0scj1SZWdFeHAoIl5ooRfYPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpO3krAHQV4ABoBWEMYz1bXQUJBGQ9AcYMO2Rve0F7GGI9YTt0cnkFDABlQZMYZT0hIWImJgEkUCE9Yi5sb2NhdGlvbi5ocmVmKWI6ewEtkGwoYi5mb28pO2U9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZT0hMX0BXghmPWUZFwBmARYMaWYoZil5AGc-XgAMO2Q9YnUfIfQ1QiRyZWZlcnJlcnx8AZckfWVsc2UgZz1kLA3LAGMp3zBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9sfX13aGlsZShhJiZiIT1hKTtiPTA7Zm9yKGE9Y43NdC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaBmrIdVl5QBnJRYlAgRkPTIEARwwPD1kOy0tZKHYSGY9Y1tkXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZBXmBCYmAcwBOwQ7MEFlJVoIJiZkBUgBGwgpO2MFrRB2KGIsZ7XoFGMuZz9jLgX6DDpjLmkBQAB9teYAdqGhHCl7dGhpcy5pQdUBCQhnPWMZIgB1HSIIdXJsESQUaD0hIWM7BS8FiCUKvfoAd3VJHHQoKSxjPWEu8Qo8Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4QKX19LDBVoCQwPD1jP2Euc3ViFmsJHCgwLGMpOmF9CeAMLnJmbC7oBxoUCWhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnpwUGaFCk7Cjwvc8WYbD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFLVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbweV9iPUFLQW1mLUN2OUlVekhlWThOZk4xeTFGc21LdC14WWpLVV9UUUF2ZTh5S1E1bjk1SGlEVmJXdUMzTjN0RDg3MFBHLXEwNEcwcHdlalRNU0lCdWNvbU1tT3p3WTlkZ3hUYWlRIiBib3JkZXI9MCB3aWR0aD0xIGhlDrULID0xIGFsdD0iIjEagGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQxYRDASIARoRDDYIARb2CQhhZHNGNw8xBjx4YmZlX2JhY2tmaWxsLmpzAWUttQ1TAD6dJCAge3IzcHgoJzcenAwcJyk7fSkoKTs96hC3EAoQSAGdNFBPUlRfUEFSQU1TEqIQkSOKlADwgWFkZmV0Y2g_YWRrPTI5MzgyNjA1NDImYWRzYWZlPW1lZGl1bSZjbGllbnQ9Y2EtcHViLTMwNzY4OTAwMTI3NDE0NjcmZm9ybWF0PTMwMHgyNTBfYXMmaXA9MTg1LjIxMy4xNTUuMTYyJm91dHB1dD1odG1sJnVudmlld2VkX3Bvc2lBjSBfc3RhcnQ9MSaheBG-NvcNECZzdWJfDYkAYkGP9IIHci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1Oc090QUNWRzdRQS1WVTBBZU5nTkFFT2FEUUJXSFEwQVNoMU5BRktkVFFCUzNVMEFZSjJOQUVkZHpRQlUzYzBBWHgzTkFHOGR6UUJ3SGMwQWRkM05BSHRkelFCLW5jMEFmdDNOQUVPZURRQkVuZzBBUlI0TkFFZGVEUUJIbmcwQVNGNE5BRkxjMEVCVTNOQkFWTEFfUUdxSFZ3QzFfYUlBbG42aUFKNFFLb0NKMEtxQWp0YXFnTFBZYW9DX1hpcUFwNklxZ0tPaXFvQ09JdXFBb0NicWdLQm02b0NncHVxQXRlZ3FnS2lxS29DdUxDcUFubXhxZ0pGd0tvQ2JNU3FBbVBOcWdLR3phb0NhOUtxQXJUYnFnSlYzcW9DeU9LcUFxRGxxZ0pFNnFvQ3AtcXFBbERycWdMTzY2b0NCLXlxQXJydnFnSk84cW9DZFBLcUFyRHpxZ0tmOUtvQzVmU3FBc1QycWdLbjk2b0NSdmlxQW4zNHFnSmctYW9DcWZxcUFpYjdxZ0pDLTZvQ2hQdXFBb2Y3cWdJSF9Lb0NEZjZxQW1ELXFnTDZfcW9DZF8tcUFrVUJxd0xFQWFzQ0tnS3JBalVDcXdKQ0Fxc0NLZ09yQW9FRHF3S1ZBNnNDblFPckF1c0Vxd0lLQmFzQ0xBV3JBbDhGcXdMbEJhc0Nsd2FyQW9ZSHF3S1NCNnNDWGdpckFzMElxd0pmOXEwQ3hyUEZCUWZhZndnRmhXSVF6cUUxRVZiSy14SzYzUHNTZU4zN0VnbmYteExXNGZzU3otZjdFbnZwLXhKczd2c1NiZTc3RWtyeS14TGk4dnNTN1BQN0VnWDAteEwtOWZzU1FQYjdFbEQyLXhJOTlfc1N3X2Y3RXVsYjBCTmJuLW9VWUtMcUZCbGxjUmFqZ2FnWG5Nc2NHUGhXYXhvcEl2cEM2N1c5YVEmZXhrPTc3Nzk2NzcwMCZhd2JpZF9jPUFLQW1mLUFXTUJYaTFlMXMyd0RvOEFOS09ZdXd6bndJWV9EMmlXaEJZR2l1cUQ1aWljTGszVFRxQWdXcEJnYTN0NnB4eE1OYUJCUnNsOV9GZkc1cTJHLVA4UWFCX0czcDJvWW1QUWFXMjdRbDlVM014R2hNMW9NUUdIUkZKQnhRZ21vT2NMQVVJN3JVZ1V5NXVOSnVVUEM2TUlZU19fTnN5OU9JbGNCWkR3RVRqSnhoQmJra29JUSZhd2JpZF9kPUFLQW1mLUFWd25HNFJZQ1J5Tzh1ekM5UU9yNDFLSTk1bzhsVkFCSUhrUmZIaVRBZ2w5bU9ZZm5hMEFMTGotWFV4bU5icDJmUnBrUUhuZDBYZWktWlozbENKWVppM1hSdzZHSEd5cW5OQjFpWjRtZDMyUVdFTmNHZ3FKa0xqOEJmelM2UVRhenlnejNtdUdXazJ4TjFTNWtsckphbzB5Tmh1ZlYwWVo5dWczd0FqM1RubTJWVnByNl9ONjB4WGF3Wjg4MkdLM2RfTFlyMUxBUDhzZmkxWXNlTVI5WUQ3R0NtSk5aUml1SUQxMXZxWlIzSkNCVXBFbzdvVE4tQVlfT3BHcWROSDFUSFctOUs3TkEtZGpEUGg3bFItcy13c1czVkVQUlp2bXdPcWRwUXkxbjZsTUdPaFZWWXI1OXhQRmt5TUI2aVNQc2dvd0JqWVpWTlEwSjNjWHlUQ244ZnpWMFdOdVZZbmNKT2I2M3p5T0FCOGxiZkNYY1JRQkZuQzBPczRkVmtoSU81NkJTbzdfNy10MUdheU83MlRaZF9sa09UU3praDlkQjM1Z2tON29qejNoRmdQMVV3c0NFdnJ6eFVqTHFGaGtHVmUwazdsWjZRREU3YnExVnZ4c0lxaG1CUVBGcVNvaEwwUDRlRUlRNm5kaE13OUZNeHU5bEItVUluOTBWelRkSFhtT2RmMnRUMGRlYzQ5SFg4TDVwSG1teFdZbm85alpuR0FBRjNHZVB5RHdjMXFlR3Q5aklBaVFWcFIydkVvbjcyWHpfVElkXzRqempFQjBuZmE5NW10Vl9XYkV4MGxvR0k5STJiZXBQVzU0QXZPaTZuazI5VllQMFYyZFNrWmQ4MnBTN2YtcHhTUkVhWlA5b0huMF9VUDVBT3lzZHU1YkFPaWROV2RnOEVIU3VLYkVjZWVud280ZXFHTndReVUzQVVnNGRkdVgtUmlLUUdTanp3NVpJZjl3a3hPbmNXZWd2NFdUMGxWdXllM1dGX0p5b3o2dmhKQjdnejdaOC1pUFBObV9pMjJhZmVseWowRXBlSDM1STg2bDhaVXR6T1MtMDRqZ0JDdTAteEJkd2xZWUZpR2o2OXRHN2xZdW54Rk1Mb2FiU2FLNmo3TmJjUHk5LVU0RkYzRnN1aEstN05jbmU1Nm96Z3o3RFptdWpSSlFvJmNpZD1DQUFTQk9SbzRqcyZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-gBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuHgYMEs4JOtQJ9FMBQjExTUotZVRDVU5YOWV3WFBrUEhLaWlnSXJlcG90TjhNMzhDc1JlQXRlNEU2U0dvZDczT1J5MGctVUNzTW1scEMyeGItTmo5OGxzbVNmMXl2N3BhWjQ0VHN3dncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoRNzcyMDUyNTY5MTg5MjYwODgiCDc3MjIxNzkzKgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFvo_Qm5TSwKN0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAk8oAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzQ1OTUxNTkzNTm6Bw8IBSkAIAGxKLoGQADIBwDSBw0JDUQFHAjaBwYJ1kTgBwDqBwIIAPAH7PsDiggCEAA.&s=52bb675538f455d56a3c8548792acfd0ae6d231d

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1652202015&bdh=VWeXh0Xtj096MZbFe0CPCe0PlYk.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=630963215&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssZ0XdWgsyj9dR3iMeufgUhpuzWloOEMmSca9ZXHBZodkflS10bG07fTi-S75qg2y2Bn1iKnCUXzTap7Hgb7ZDrtwgR16GD4TwQYZqhZujfDyYYOCaeg2avy-v9Mdybc0mYC7vWzuVsVgtqae6b97fNynPdAEJ3LCC9UTGfu0sj0XnAEfzMKPHyj1om8JxsERDz2yjhz8MTw3J0eDs6xD7Txm07D705VaoMlJ4Nh4hoHSu7-tFjwAjI1Ii7AKhb-94eyGLXbRp17HYzEC6FBuvq-ED2u_TUrA8vfua6Z-9yGtwkp1VHDCc9Fyt9atL7jBkgLOwz%2526sai%253DAMfl-YTyEJwHt_Nj_Fs7QPRaeC6Fds2QhyefUosean5QQmALEOTpTAGCn5CMoq4iZVJTP07MZV_R4Z5y-dP3tBzYd__ZPlDEh0cNeowd7zC5N2IIqB0LTCi9nFaRal_ZfWQ%2526sig%253DCg0ArKJSzBrKzzh_y7HFEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

6c6a3f325148709b5429e4f7a10d31d467d0251cf209c19cdbd894f19fd80351

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

AN-X-Request-Uuid: c994a563-e7f7-4204-af02-4702ffb9bd23
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Tue, 10 May 2022 17:00:16 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Creative-ID: 77221793
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame BD24 52 KB
17 KB 27ms
7ms Document
text/html 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1652202015&bdh=VWeXh0Xtj096MZbFe0CPCe0PlYk.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=630963215&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssZ0XdWgsyj9dR3iMeufgUhpuzWloOEMmSca9ZXHBZodkflS10bG07fTi-S75qg2y2Bn1iKnCUXzTap7Hgb7ZDrtwgR16GD4TwQYZqhZujfDyYYOCaeg2avy-v9Mdybc0mYC7vWzuVsVgtqae6b97fNynPdAEJ3LCC9UTGfu0sj0XnAEfzMKPHyj1om8JxsERDz2yjhz8MTw3J0eDs6xD7Txm07D705VaoMlJ4Nh4hoHSu7-tFjwAjI1Ii7AKhb-94eyGLXbRp17HYzEC6FBuvq-ED2u_TUrA8vfua6Z-9yGtwkp1VHDCc9Fyt9atL7jBkgLOwz%2526sai%253DAMfl-YTyEJwHt_Nj_Fs7QPRaeC6Fds2QhyefUosean5QQmALEOTpTAGCn5CMoq4iZVJTP07MZV_R4Z5y-dP3tBzYd__ZPlDEh0cNeowd7zC5N2IIqB0LTCi9nFaRal_ZfWQ%2526sig%253DCg0ArKJSzBrKzzh_y7HFEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 10 May 2022 17:00:16 GMT
ETag: "623de86a-cf34"
Expires: Wed, 11 May 2022 17:00:18 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CB21 0
0 68ms
67ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvSMVUpLzlXYpgUrpa2QvA8ClwiBty6wcNxAMjZP7IRqRYTq4LpNY5_GgV9lGCMa7UsLLIJI8F4n24oGQcm4vtitukwCCs7RBZPjiqxvsECoZlEhz-aAsVT54YlysOgm9zIuw9-gyLKQaQ67pMmH3zo2sn4YjoRj1i_lRHQMs_boGQkAbKEg4aZeHO5p44WnZoYc0jl2sn-at8gH6XrfbXbITcTOqv4P5C-D4lnodKnQ2JU27PXZAOtcfjrum8a8PNY8QdP-z1v7uvUNGw4ij-DD6RSP4cpxpu67SG15qoJlbZzuRz3hDnP_Rr5gr3z6mxLI4kd7lkd_9g&sai=AMfl-YTX__Y85BvUgRs8J182skkE4lDJ7xkA4JvNVv0YhL_Hnc4Fl-yn3wBJ6s6e1p8Zduh_und2xctBjlw4MdMoVNDglPj1FY3687IrhW0J3ZDoX7MwwwWjcvBd04jdmKk&sig=Cg0ArKJSzJR6z1hMgaK6EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 10 May 2022 17:00:16 GMT

GET
DATA 200
OK truncated
/ Frame CB21 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 859a457a8526e9d02b9dd24a557ec2c1b31a6b56a63b36baeece7be4db2b6103

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame BD24 0
747 B 19ms
19ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 18c80b43-3463-4a23-8393-a7176a04159a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0A64 8 KB
1 KB 134ms
45ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 10 May 2022 15:02:48 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 10 May 2022 17:00:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 10 May 2022 17:00:16 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/ Frame 0A64 2 KB
1 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f4362568e9be366759f9ada329e928f398f49333040bc12fcf2de18483d1f52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 09 May 2022 19:15:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78303
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1201
x-xss-protection: 0
server: cafe
etag: 17441257144546641969
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 May 2022 19:15:13 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/ Frame 0A64 25 KB
10 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36998456859e35cf76812894575b0203d48ad8ac11d3165c5449d1fa73f19800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9783
x-xss-protection: 0
server: cafe
etag: 9821519945299111448
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:55:17 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/ Frame 0A64 3 KB
1 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b59e198c356c79d1ba89670c50cdb7e54181037f277ee106126caf570278bc11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:49:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 641
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
server: cafe
etag: 15450667304708860052
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:49:35 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0A64 120 KB
37 KB 56ms
56ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfaf60508a77b732490cebbf93a415622f5d33fc0a63f88365807b71a21c25b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652096384767712"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 May 2022 17:00:16 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/ Frame 0A64 19 KB
8 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e2268bde09038607e2997012b5d696ce68013a1fdd96e646bb03890b98f73d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:49:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 672
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7673
x-xss-protection: 0
server: cafe
etag: 8553123382206257723
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:49:04 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0A64 0
0 48ms
48ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRF_GOxXMaUIPKlR6J4cdqKHu-SRd9c8wLxb_BtJ9u3dToqfFZyEapIiLSARw6CVlKK37r2n73CgQxcGEHRkt1Y3tIBtg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H2 200 9ff07bee171aee1760b215e6224d8c97.js Show response
www.gstatic.com/mysidia/ Frame 0A64 39 KB
15 KB 148ms
40ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/9ff07bee171aee1760b215e6224d8c97.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c35b9f648592bb6620200a0b4b7d504882974463b9d1fc06f31977768029159

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 09 May 2022 10:44:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108925
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15144
x-xss-protection: 0
last-modified: Thu, 05 May 2022 20:56:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 07 Aug 2022 10:44:51 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0A64 0
17 B 81ms
81ms Image
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CifzHH5p6YvC3DuWI9u8Pz-eA6Aa-5tmRaJ7F0uH_Dp2y9I-HHRABIOaX1iVgleKQgqAHoAHw9u6RA8gBAakCmw9viv2zsT6oAwHIA8sEqgT2AU_QoaI0o-WpefMuTrI2Z8GRuxawVLM6Ly7ZuA537t3dLgpoDItNWBfnLbm7Xb5quFvdLlpc0TFj0ny6_Go_8b1hEZfMdkk1sJ25RctzDtHXwWyi0WFe4Gbj7j5I2wrHUD9SHw2f3av7SwaNkiWMhNQAEuC-65KQghTRdVLfplInZckkFLJhUA4F5fTNYklQMKWLlX_qMeS6sfjo0MmyH-Z4W7qPVbviD0PYdglJn1ql4kfsZXKITTk3aJyoanwrzIymRNTWShJiCEyt686K-RLKpNeG4FukM-sN7i-Ze_oFZnjdRBLI0csOUx5-F-c8IkSrweyGHcAE3OzYu4sDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGAB_iIkW6oB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAdIICQiA4YAQEAEYAPIIDmJpZGRlci0zMDU2NDQ3gAoEyAsB2BMMiBQa0BUBgBcBshcICgYIABIAGAA&sigh=QOGxFPKVr6o&uach_m=[UACH]&pr=10:0.030742&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 10 May 2022 17:00:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 12C2 0
20 B 70ms
70ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-Cv9IUzHeY8NfN1y1FsmKt-xYjKU_TQAve8yKQ5n95HiDVbWuC3N3tD870PG-q04G0pwejTMSIBucomMmOzwY9dgxTaiQ

Requested by

Host: ams1-ib.adnxs.com
URL: https://ams1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLANfBMwBoAAAMA1gAFAQigtOqTBhCIhsjL2riSiQEY6YKysa-ApeE9KjYJkQw5tp4hjD8RdHD6xEuBhj8ZAAAA4FG4rj8hdHD6xEuBhj8pkQwJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3NaMFhkV2dzeWo5ZFIzaU1ldWZnVWhwdXpXbG9PRU1tU2NhOVpYSEJab2RrZmxTMTBiRzA3ZlRpLVM3NXFnMnkyQm4xaUtuQ1VYelRhcDdIZ2I3WkRydHdnUjE2R0Q0VHdRWVpxaFp1amZEeVlZT0NhZWcyYXZ5LXY5TWR5YmMwbVlDN3ZXenVWc1ZndHFhZTZiOTdmTnluUGRBRUozTENDOVVUR2Z1MHNqMFhuQUVmek1LUEh5ajFvbThKeHNFUkR6MnlqaHo4TVR3M0owZURzNnhEN1R4bTA3RDcwNVZhb01sSjROaDRob0hTdTctdEZqd0FqSTFJaTdBS2hiLTk0ZXlHTFhiUnAxN0hZekVDNkZCdXZxLUVEMnVfVFVyQTh2ZnVhNlotOXlHdHdrcDFWSERDYzlGeXQ5YXRMN2pCa2dMT3d6JTI1MjZzYWklMjUzREFNZmwtWVR5RUp3SHRfTmpfRnM3UVBSYWVDNkZkczJRaHllZlVvc2VhbjVRUW1BTEVPVHBUQUdDbjVDTW9xNGlaVkpUUDA3TVpWX1I0WjV5LWRQM3RCellkX19aUGxERWgwY05lb3dkN3pDNU4ySUlxQjBMVENpOW5GYVJhbF9aZldRJTI1MjZzaWclMjUzRENnMEFyS0pTekJyS3p6aF95N0hGRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGW9MQBOi8vd2hlcmVnb2VzLmNvbS_yAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk3Nzc5Njc3MDDyAr8VCgtQUkVfU0NSSVBUUxKvFTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjt2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhDSmIO2QrKylpZihkIGluIGEmJmFbZF09PT1jKXJldHVybiBkO3IFCQwtMX07JWKaOgEAZi2ZOCBsKGEpe2xbIiAiXShhKQ1OCCBhfQkTAD0RKBAoKXt9OxENBCBuATVYYT12b2lkIDA9PT1hP2RvY3VtZW50OmEVQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FAHAhh3QsZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgA4PVtdKTt2YXIgYj1uKGEuEXwEKTshKQQpewEaAGUuugAZFwRmPVpTAFAsZz1rKGYsYik7MDw9ZyYmQXJyYXldQ6hzcGxpY2UuY2FsbChmLGcsMSl9Yi5yZW1vdmVFdmVudExpc3RlbmVyJiZiThcANCgibG9hZCIsZSwhMSk7tjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAQmJkZIAAAoNmoAHGIuc3JjPWM7WjEBGC5wdXNoKGIu0QEEcSgpfARhPTGSNC5jdXJyZW50U2NyaXB0TRoAKDI5AjBudWxsOmEpJiYiNzciQUtoLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RR0scj1SZWdFeHAoIl5ooRfYPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpO3krAHQV4ABoBWEMYz1bXQUJBGQ9AcYMO2Rve0F7GGI9YTt0cnkFDABlQZMYZT0hIWImJgEkUCE9Yi5sb2NhdGlvbi5ocmVmKWI6ewEtkGwoYi5mb28pO2U9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZT0hMX0BXghmPWUZFwBmARYMaWYoZil5AGc-XgAMO2Q9YnUfIfQ1QiRyZWZlcnJlcnx8AZckfWVsc2UgZz1kLA3LAGMp3zBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9sfX13aGlsZShhJiZiIT1hKTtiPTA7Zm9yKGE9Y43NdC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaBmrIdVl5QBnJRYlAgRkPTIEARwwPD1kOy0tZKHYSGY9Y1tkXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZBXmBCYmAcwBOwQ7MEFlJVoIJiZkBUgBGwgpO2MFrRB2KGIsZ7XoFGMuZz9jLgX6DDpjLmkBQAB9teYAdqGhHCl7dGhpcy5pQdUBCQhnPWMZIgB1HSIIdXJsESQUaD0hIWM7BS8FiCUKvfoAd3VJHHQoKSxjPWEu8Qo8Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4QKX19LDBVoCQwPD1jP2Euc3ViFmsJHCgwLGMpOmF9CeAMLnJmbC7oBxoUCWhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnpwUGaFCk7Cjwvc8WYbD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFLVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbweV9iPUFLQW1mLUN2OUlVekhlWThOZk4xeTFGc21LdC14WWpLVV9UUUF2ZTh5S1E1bjk1SGlEVmJXdUMzTjN0RDg3MFBHLXEwNEcwcHdlalRNU0lCdWNvbU1tT3p3WTlkZ3hUYWlRIiBib3JkZXI9MCB3aWR0aD0xIGhlDrULID0xIGFsdD0iIjEagGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQxYRDASIARoRDDYIARb2CQhhZHNGNw8xBjx4YmZlX2JhY2tmaWxsLmpzAWUttQ1TAD6dJCAge3IzcHgoJzcenAwcJyk7fSkoKTs96hC3EAoQSAGdNFBPUlRfUEFSQU1TEqIQkSOKlADwgWFkZmV0Y2g_YWRrPTI5MzgyNjA1NDImYWRzYWZlPW1lZGl1bSZjbGllbnQ9Y2EtcHViLTMwNzY4OTAwMTI3NDE0NjcmZm9ybWF0PTMwMHgyNTBfYXMmaXA9MTg1LjIxMy4xNTUuMTYyJm91dHB1dD1odG1sJnVudmlld2VkX3Bvc2lBjSBfc3RhcnQ9MSaheBG-NvcNECZzdWJfDYkAYkGP9IIHci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1Oc090QUNWRzdRQS1WVTBBZU5nTkFFT2FEUUJXSFEwQVNoMU5BRktkVFFCUzNVMEFZSjJOQUVkZHpRQlUzYzBBWHgzTkFHOGR6UUJ3SGMwQWRkM05BSHRkelFCLW5jMEFmdDNOQUVPZURRQkVuZzBBUlI0TkFFZGVEUUJIbmcwQVNGNE5BRkxjMEVCVTNOQkFWTEFfUUdxSFZ3QzFfYUlBbG42aUFKNFFLb0NKMEtxQWp0YXFnTFBZYW9DX1hpcUFwNklxZ0tPaXFvQ09JdXFBb0NicWdLQm02b0NncHVxQXRlZ3FnS2lxS29DdUxDcUFubXhxZ0pGd0tvQ2JNU3FBbVBOcWdLR3phb0NhOUtxQXJUYnFnSlYzcW9DeU9LcUFxRGxxZ0pFNnFvQ3AtcXFBbERycWdMTzY2b0NCLXlxQXJydnFnSk84cW9DZFBLcUFyRHpxZ0tmOUtvQzVmU3FBc1QycWdLbjk2b0NSdmlxQW4zNHFnSmctYW9DcWZxcUFpYjdxZ0pDLTZvQ2hQdXFBb2Y3cWdJSF9Lb0NEZjZxQW1ELXFnTDZfcW9DZF8tcUFrVUJxd0xFQWFzQ0tnS3JBalVDcXdKQ0Fxc0NLZ09yQW9FRHF3S1ZBNnNDblFPckF1c0Vxd0lLQmFzQ0xBV3JBbDhGcXdMbEJhc0Nsd2FyQW9ZSHF3S1NCNnNDWGdpckFzMElxd0pmOXEwQ3hyUEZCUWZhZndnRmhXSVF6cUUxRVZiSy14SzYzUHNTZU4zN0VnbmYteExXNGZzU3otZjdFbnZwLXhKczd2c1NiZTc3RWtyeS14TGk4dnNTN1BQN0VnWDAteEwtOWZzU1FQYjdFbEQyLXhJOTlfc1N3X2Y3RXVsYjBCTmJuLW9VWUtMcUZCbGxjUmFqZ2FnWG5Nc2NHUGhXYXhvcEl2cEM2N1c5YVEmZXhrPTc3Nzk2NzcwMCZhd2JpZF9jPUFLQW1mLUFXTUJYaTFlMXMyd0RvOEFOS09ZdXd6bndJWV9EMmlXaEJZR2l1cUQ1aWljTGszVFRxQWdXcEJnYTN0NnB4eE1OYUJCUnNsOV9GZkc1cTJHLVA4UWFCX0czcDJvWW1QUWFXMjdRbDlVM014R2hNMW9NUUdIUkZKQnhRZ21vT2NMQVVJN3JVZ1V5NXVOSnVVUEM2TUlZU19fTnN5OU9JbGNCWkR3RVRqSnhoQmJra29JUSZhd2JpZF9kPUFLQW1mLUFWd25HNFJZQ1J5Tzh1ekM5UU9yNDFLSTk1bzhsVkFCSUhrUmZIaVRBZ2w5bU9ZZm5hMEFMTGotWFV4bU5icDJmUnBrUUhuZDBYZWktWlozbENKWVppM1hSdzZHSEd5cW5OQjFpWjRtZDMyUVdFTmNHZ3FKa0xqOEJmelM2UVRhenlnejNtdUdXazJ4TjFTNWtsckphbzB5Tmh1ZlYwWVo5dWczd0FqM1RubTJWVnByNl9ONjB4WGF3Wjg4MkdLM2RfTFlyMUxBUDhzZmkxWXNlTVI5WUQ3R0NtSk5aUml1SUQxMXZxWlIzSkNCVXBFbzdvVE4tQVlfT3BHcWROSDFUSFctOUs3TkEtZGpEUGg3bFItcy13c1czVkVQUlp2bXdPcWRwUXkxbjZsTUdPaFZWWXI1OXhQRmt5TUI2aVNQc2dvd0JqWVpWTlEwSjNjWHlUQ244ZnpWMFdOdVZZbmNKT2I2M3p5T0FCOGxiZkNYY1JRQkZuQzBPczRkVmtoSU81NkJTbzdfNy10MUdheU83MlRaZF9sa09UU3praDlkQjM1Z2tON29qejNoRmdQMVV3c0NFdnJ6eFVqTHFGaGtHVmUwazdsWjZRREU3YnExVnZ4c0lxaG1CUVBGcVNvaEwwUDRlRUlRNm5kaE13OUZNeHU5bEItVUluOTBWelRkSFhtT2RmMnRUMGRlYzQ5SFg4TDVwSG1teFdZbm85alpuR0FBRjNHZVB5RHdjMXFlR3Q5aklBaVFWcFIydkVvbjcyWHpfVElkXzRqempFQjBuZmE5NW10Vl9XYkV4MGxvR0k5STJiZXBQVzU0QXZPaTZuazI5VllQMFYyZFNrWmQ4MnBTN2YtcHhTUkVhWlA5b0huMF9VUDVBT3lzZHU1YkFPaWROV2RnOEVIU3VLYkVjZWVud280ZXFHTndReVUzQVVnNGRkdVgtUmlLUUdTanp3NVpJZjl3a3hPbmNXZWd2NFdUMGxWdXllM1dGX0p5b3o2dmhKQjdnejdaOC1pUFBObV9pMjJhZmVseWowRXBlSDM1STg2bDhaVXR6T1MtMDRqZ0JDdTAteEJkd2xZWUZpR2o2OXRHN2xZdW54Rk1Mb2FiU2FLNmo3TmJjUHk5LVU0RkYzRnN1aEstN05jbmU1Nm96Z3o3RFptdWpSSlFvJmNpZD1DQUFTQk9SbzRqcyZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-gBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuHgYMEs4JOtQJ9FMBQjExTUotZVRDVU5YOWV3WFBrUEhLaWlnSXJlcG90TjhNMzhDc1JlQXRlNEU2U0dvZDczT1J5MGctVUNzTW1scEMyeGItTmo5OGxzbVNmMXl2N3BhWjQ0VHN3dncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoRNzcyMDUyNTY5MTg5MjYwODgiCDc3MjIxNzkzKgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFvo_Qm5TSwKN0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAk8oAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzQ1OTUxNTkzNTm6Bw8IBSkAIAGxKLoGQADIBwDSBw0JDUQFHAjaBwYJ1kTgBwDqBwIIAPAH7PsDiggCEAA.&s=52bb675538f455d56a3c8548792acfd0ae6d231d

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 12C2 11 KB
5 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b44a4b2aac311fbc8c7003fe8401d53ed6b3c68a2f88fa522c5d92b25fdb2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:50:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 590
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4881
x-xss-protection: 0
server: cafe
etag: 17592260700507526713
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 10 May 2022 17:50:26 GMT

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 12C2 0
819 B 19ms
18ms Image
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL7CvBMewUAAAMA1gAFAQigtOqTBhCIhsjL2riSiQEY6YKysa-ApeE9KjYJkQw5tp4hjD8RdHD6xEuBhj8ZAAAA4FG4rj8hdHD6xEuBhj8pkQwJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3NaMFhkV2dzeWo5ZFIzaU1ldWZnVWhwdXpXbG9PRU1tU2NhOVpYSEJab2RrZmxTMTBiRzA3ZlRpLVM3NXFnMnkyQm4xaUtuQ1VYelRhcDdIZ2I3WkRydHdnUjE2R0Q0VHdRWVpxaFp1amZEeVlZT0NhZWcyYXZ5LXY5TWR5YmMwbVlDN3ZXenVWc1ZndHFhZTZiOTdmTnluUGRBRUozTENDOVVUR2Z1MHNqMFhuQUVmek1LUEh5ajFvbThKeHNFUkR6MnlqaHo4TVR3M0owZURzNnhEN1R4bTA3RDcwNVZhb01sSjROaDRob0hTdTctdEZqd0FqSTFJaTdBS2hiLTk0ZXlHTFhiUnAxN0hZekVDNkZCdXZxLUVEMnVfVFVyQTh2ZnVhNlotOXlHdHdrcDFWSERDYzlGeXQ5YXRMN2pCa2dMT3d6JTI1MjZzYWklMjUzREFNZmwtWVR5RUp3SHRfTmpfRnM3UVBSYWVDNkZkczJRaHllZlVvc2VhbjVRUW1BTEVPVHBUQUdDbjVDTW9xNGlaVkpUUDA3TVpWX1I0WjV5LWRQM3RCellkX19aUGxERWgwY05lb3dkN3pDNU4ySUlxQjBMVENpOW5GYVJhbF9aZldRJTI1MjZzaWclMjUzRENnMEFyS0pTekJyS3p6aF95N0hGRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGWmDovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPoAQq_AREsYHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24FPAkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQjExTUotZVRDVU5YOWV3WFBrUEhLaWlnSXJlcG90TjhNMzhDc1JlQXRlNEU2U0dvZDczT1J5MGctVUNzTW1scEMyeGItTmo5OGxzbVNmMXl2N3BhWjQ0VHN3dncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoRNzcyMDUyNTY5MTg5MjYwODgiCDc3MjIxNzkzKgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFvo_Qm5TSwKN0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAkzGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM0NTk1MTU5MzU5ugcPCAABKTwgADAAOLoGQADIBwDSBw0JEUcBHAjaBwYJJUTgBwDqBwIIAPAH7PsDiggCEAA.&s=3ca404d624cd415e2591fffedd558225f1185fdd

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: abed825a-5b6f-4dd8-9797-23c38b3487d1
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 12C2 85 KB
29 KB 8ms
7ms Script
application/x-javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: ams1-ib.adnxs.com
URL: https://ams1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLANfBMwBoAAAMA1gAFAQigtOqTBhCIhsjL2riSiQEY6YKysa-ApeE9KjYJkQw5tp4hjD8RdHD6xEuBhj8ZAAAA4FG4rj8hdHD6xEuBhj8pkQwJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3NaMFhkV2dzeWo5ZFIzaU1ldWZnVWhwdXpXbG9PRU1tU2NhOVpYSEJab2RrZmxTMTBiRzA3ZlRpLVM3NXFnMnkyQm4xaUtuQ1VYelRhcDdIZ2I3WkRydHdnUjE2R0Q0VHdRWVpxaFp1amZEeVlZT0NhZWcyYXZ5LXY5TWR5YmMwbVlDN3ZXenVWc1ZndHFhZTZiOTdmTnluUGRBRUozTENDOVVUR2Z1MHNqMFhuQUVmek1LUEh5ajFvbThKeHNFUkR6MnlqaHo4TVR3M0owZURzNnhEN1R4bTA3RDcwNVZhb01sSjROaDRob0hTdTctdEZqd0FqSTFJaTdBS2hiLTk0ZXlHTFhiUnAxN0hZekVDNkZCdXZxLUVEMnVfVFVyQTh2ZnVhNlotOXlHdHdrcDFWSERDYzlGeXQ5YXRMN2pCa2dMT3d6JTI1MjZzYWklMjUzREFNZmwtWVR5RUp3SHRfTmpfRnM3UVBSYWVDNkZkczJRaHllZlVvc2VhbjVRUW1BTEVPVHBUQUdDbjVDTW9xNGlaVkpUUDA3TVpWX1I0WjV5LWRQM3RCellkX19aUGxERWgwY05lb3dkN3pDNU4ySUlxQjBMVENpOW5GYVJhbF9aZldRJTI1MjZzaWclMjUzRENnMEFyS0pTekJyS3p6aF95N0hGRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGW9MQBOi8vd2hlcmVnb2VzLmNvbS_yAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk3Nzc5Njc3MDDyAr8VCgtQUkVfU0NSSVBUUxKvFTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjt2YXIgaz1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBkPTA7ZDxhDSmIO2QrKylpZihkIGluIGEmJmFbZF09PT1jKXJldHVybiBkO3IFCQwtMX07JWKaOgEAZi2ZOCBsKGEpe2xbIiAiXShhKQ1OCCBhfQkTAD0RKBAoKXt9OxENBCBuATVYYT12b2lkIDA9PT1hP2RvY3VtZW50OmEVQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FAHAhh3QsZCl7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgA4PVtdKTt2YXIgYj1uKGEuEXwEKTshKQQpewEaAGUuugAZFwRmPVpTAFAsZz1rKGYsYik7MDw9ZyYmQXJyYXldQ6hzcGxpY2UuY2FsbChmLGcsMSl9Yi5yZW1vdmVFdmVudExpc3RlbmVyJiZiThcANCgibG9hZCIsZSwhMSk7tjoAEGVycm9yDTsYfTtiLmFkZEJzAD4UAD5wAD4gAAQmJkZIAAAoNmoAHGIuc3JjPWM7WjEBGC5wdXNoKGIu0QEEcSgpfARhPTGSNC5jdXJyZW50U2NyaXB0TRoAKDI5AjBudWxsOmEpJiYiNzciQUtoLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RR0scj1SZWdFeHAoIl5ooRfYPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpO3krAHQV4ABoBWEMYz1bXQUJBGQ9AcYMO2Rve0F7GGI9YTt0cnkFDABlQZMYZT0hIWImJgEkUCE9Yi5sb2NhdGlvbi5ocmVmKWI6ewEtkGwoYi5mb28pO2U9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZT0hMX0BXghmPWUZFwBmARYMaWYoZil5AGc-XgAMO2Q9YnUfIfQ1QiRyZWZlcnJlcnx8AZckfWVsc2UgZz1kLA3LAGMp3zBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9sfX13aGlsZShhJiZiIT1hKTtiPTA7Zm9yKGE9Y43NdC0xO2I8PWE7KytiKWNbYl0uZGVwdGg9YS1iO2I9aCErOR4BrjUqOGFuY2VzdG9yT3JpZ2luc24cAA1rAD0ddQApCYYMMTthPBGKTDsrK2EpZz1jW2FdLGcudXJsfHwoBQguQgE6dgAUW2EtCjFdIQwYLGcuaD0hMAHjKSIAaBmrIdVl5QBnJRYlAgRkPTIEARwwPD1kOy0tZKHYSGY9Y1tkXSwhZyYmci50ZXN0KGYBjyApJiYoZz1mKSwFDiwmJiFmLmgpe2I9ZjtFGwB9DV0AZBXmBCYmAcwBOwQ7MEFlJVoIJiZkBUgBGwgpO2MFrRB2KGIsZ7XoFGMuZz9jLgX6DDpjLmkBQAB9teYAdqGhHCl7dGhpcy5pQdUBCQhnPWMZIgB1HSIIdXJsESQUaD0hIWM7BS8FiCUKvfoAd3VJHHQoKSxjPWEu8Qo8Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4QKX19LDBVoCQwPD1jP2Euc3ViFmsJHCgwLGMpOmF9CeAMLnJmbC7oBxoUCWhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnpwUGaFCk7Cjwvc8WYbD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFLVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbweV9iPUFLQW1mLUN2OUlVekhlWThOZk4xeTFGc21LdC14WWpLVV9UUUF2ZTh5S1E1bjk1SGlEVmJXdUMzTjN0RDg3MFBHLXEwNEcwcHdlalRNU0lCdWNvbU1tT3p3WTlkZ3hUYWlRIiBib3JkZXI9MCB3aWR0aD0xIGhlDrULID0xIGFsdD0iIjEagGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQxYRDASIARoRDDYIARb2CQhhZHNGNw8xBjx4YmZlX2JhY2tmaWxsLmpzAWUttQ1TAD6dJCAge3IzcHgoJzcenAwcJyk7fSkoKTs96hC3EAoQSAGdNFBPUlRfUEFSQU1TEqIQkSOKlADwgWFkZmV0Y2g_YWRrPTI5MzgyNjA1NDImYWRzYWZlPW1lZGl1bSZjbGllbnQ9Y2EtcHViLTMwNzY4OTAwMTI3NDE0NjcmZm9ybWF0PTMwMHgyNTBfYXMmaXA9MTg1LjIxMy4xNTUuMTYyJm91dHB1dD1odG1sJnVudmlld2VkX3Bvc2lBjSBfc3RhcnQ9MSaheBG-NvcNECZzdWJfDYkAYkGP9IIHci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1Oc090QUNWRzdRQS1WVTBBZU5nTkFFT2FEUUJXSFEwQVNoMU5BRktkVFFCUzNVMEFZSjJOQUVkZHpRQlUzYzBBWHgzTkFHOGR6UUJ3SGMwQWRkM05BSHRkelFCLW5jMEFmdDNOQUVPZURRQkVuZzBBUlI0TkFFZGVEUUJIbmcwQVNGNE5BRkxjMEVCVTNOQkFWTEFfUUdxSFZ3QzFfYUlBbG42aUFKNFFLb0NKMEtxQWp0YXFnTFBZYW9DX1hpcUFwNklxZ0tPaXFvQ09JdXFBb0NicWdLQm02b0NncHVxQXRlZ3FnS2lxS29DdUxDcUFubXhxZ0pGd0tvQ2JNU3FBbVBOcWdLR3phb0NhOUtxQXJUYnFnSlYzcW9DeU9LcUFxRGxxZ0pFNnFvQ3AtcXFBbERycWdMTzY2b0NCLXlxQXJydnFnSk84cW9DZFBLcUFyRHpxZ0tmOUtvQzVmU3FBc1QycWdLbjk2b0NSdmlxQW4zNHFnSmctYW9DcWZxcUFpYjdxZ0pDLTZvQ2hQdXFBb2Y3cWdJSF9Lb0NEZjZxQW1ELXFnTDZfcW9DZF8tcUFrVUJxd0xFQWFzQ0tnS3JBalVDcXdKQ0Fxc0NLZ09yQW9FRHF3S1ZBNnNDblFPckF1c0Vxd0lLQmFzQ0xBV3JBbDhGcXdMbEJhc0Nsd2FyQW9ZSHF3S1NCNnNDWGdpckFzMElxd0pmOXEwQ3hyUEZCUWZhZndnRmhXSVF6cUUxRVZiSy14SzYzUHNTZU4zN0VnbmYteExXNGZzU3otZjdFbnZwLXhKczd2c1NiZTc3RWtyeS14TGk4dnNTN1BQN0VnWDAteEwtOWZzU1FQYjdFbEQyLXhJOTlfc1N3X2Y3RXVsYjBCTmJuLW9VWUtMcUZCbGxjUmFqZ2FnWG5Nc2NHUGhXYXhvcEl2cEM2N1c5YVEmZXhrPTc3Nzk2NzcwMCZhd2JpZF9jPUFLQW1mLUFXTUJYaTFlMXMyd0RvOEFOS09ZdXd6bndJWV9EMmlXaEJZR2l1cUQ1aWljTGszVFRxQWdXcEJnYTN0NnB4eE1OYUJCUnNsOV9GZkc1cTJHLVA4UWFCX0czcDJvWW1QUWFXMjdRbDlVM014R2hNMW9NUUdIUkZKQnhRZ21vT2NMQVVJN3JVZ1V5NXVOSnVVUEM2TUlZU19fTnN5OU9JbGNCWkR3RVRqSnhoQmJra29JUSZhd2JpZF9kPUFLQW1mLUFWd25HNFJZQ1J5Tzh1ekM5UU9yNDFLSTk1bzhsVkFCSUhrUmZIaVRBZ2w5bU9ZZm5hMEFMTGotWFV4bU5icDJmUnBrUUhuZDBYZWktWlozbENKWVppM1hSdzZHSEd5cW5OQjFpWjRtZDMyUVdFTmNHZ3FKa0xqOEJmelM2UVRhenlnejNtdUdXazJ4TjFTNWtsckphbzB5Tmh1ZlYwWVo5dWczd0FqM1RubTJWVnByNl9ONjB4WGF3Wjg4MkdLM2RfTFlyMUxBUDhzZmkxWXNlTVI5WUQ3R0NtSk5aUml1SUQxMXZxWlIzSkNCVXBFbzdvVE4tQVlfT3BHcWROSDFUSFctOUs3TkEtZGpEUGg3bFItcy13c1czVkVQUlp2bXdPcWRwUXkxbjZsTUdPaFZWWXI1OXhQRmt5TUI2aVNQc2dvd0JqWVpWTlEwSjNjWHlUQ244ZnpWMFdOdVZZbmNKT2I2M3p5T0FCOGxiZkNYY1JRQkZuQzBPczRkVmtoSU81NkJTbzdfNy10MUdheU83MlRaZF9sa09UU3praDlkQjM1Z2tON29qejNoRmdQMVV3c0NFdnJ6eFVqTHFGaGtHVmUwazdsWjZRREU3YnExVnZ4c0lxaG1CUVBGcVNvaEwwUDRlRUlRNm5kaE13OUZNeHU5bEItVUluOTBWelRkSFhtT2RmMnRUMGRlYzQ5SFg4TDVwSG1teFdZbm85alpuR0FBRjNHZVB5RHdjMXFlR3Q5aklBaVFWcFIydkVvbjcyWHpfVElkXzRqempFQjBuZmE5NW10Vl9XYkV4MGxvR0k5STJiZXBQVzU0QXZPaTZuazI5VllQMFYyZFNrWmQ4MnBTN2YtcHhTUkVhWlA5b0huMF9VUDVBT3lzZHU1YkFPaWROV2RnOEVIU3VLYkVjZWVud280ZXFHTndReVUzQVVnNGRkdVgtUmlLUUdTanp3NVpJZjl3a3hPbmNXZWd2NFdUMGxWdXllM1dGX0p5b3o2dmhKQjdnejdaOC1pUFBObV9pMjJhZmVseWowRXBlSDM1STg2bDhaVXR6T1MtMDRqZ0JDdTAteEJkd2xZWUZpR2o2OXRHN2xZdW54Rk1Mb2FiU2FLNmo3TmJjUHk5LVU0RkYzRnN1aEstN05jbmU1Nm96Z3o3RFptdWpSSlFvJmNpZD1DQUFTQk9SbzRqcyZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-gBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuHgYMEs4JOtQJ9FMBQjExTUotZVRDVU5YOWV3WFBrUEhLaWlnSXJlcG90TjhNMzhDc1JlQXRlNEU2U0dvZDczT1J5MGctVUNzTW1scEMyeGItTmo5OGxzbVNmMXl2N3BhWjQ0VHN3dncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoRNzcyMDUyNTY5MTg5MjYwODgiCDc3MjIxNzkzKgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFvo_Qm5TSwKN0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAAAAAAk8oAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwwxMzQ1OTUxNTkzNTm6Bw8IBSkAIAGxKLoGQADIBwDSBw0JDUQFHAjaBwYJ1kTgBwDqBwIIAPAH7PsDiggCEAA.&s=52bb675538f455d56a3c8548792acfd0ae6d231d
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:16 GMT
Content-Encoding: gzip
Age: 6508904
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29216
X-Served-By: cache-lga21974-LGA, cache-hhn4062-HHN
Access-Control-Allow-Origin: *, *
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
X-Timer: S1652202016.311797,VS0,VE0
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 24 Feb 2023 08:58:29 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 386514, 3463715

GET
H3 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 42CF 13 KB
5 KB 40ms
39ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ams1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 76086
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 09 May 2022 19:52:10 GMT
etag: 12223946614886178233
expires: Tue, 10 May 2022 19:52:10 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 0.000504 Show response
pr.ybp.yahoo.com/ab/secure/true/crid/7Bq29K0sEDsTVvCIAEgYMDfZxWqJLL3z/imp/OBOPIQFLxjwN4Y4iV56kf8WyDvupd99kd1lNlw3xCrUWUWDf64tPaZaly2j0gm6xGPZ6forp7AiqdbyihWEtwX_MBa5vWD7ugmsmz9kd4BRojydx8QGzw5qt32K... Frame E007 3 KB
3 KB 170ms
104ms Script
text/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://pr.ybp.yahoo.com/ab/secure/true/crid/7Bq29K0sEDsTVvCIAEgYMDfZxWqJLL3z/imp/OBOPIQFLxjwN4Y4iV56kf8WyDvupd99kd1lNlw3xCrUWUWDf64tPaZaly2j0gm6xGPZ6forp7AiqdbyihWEtwX_MBa5vWD7ugmsmz9kd4BRojydx8QGzw5qt32KeVnKhA-F5ubvUsMpViMw38OgPnn1aIQSFbFRPUECFUKaDoLudsFbsL4fJAJXaFE8Igyk__tKmWOBa-tuc7O4OeDeIOyuiNLZFdEplJq2Q3rceMbWlZwIKLg7K1t6oMeBpsUyo4ou50zqstXqf9FIijH5QTl8qVfgj7mr0O5_3xEAq7xcG23C0xfIPB3WYKdvjx0RDkBt0Cc20K3sFaCaA1wV3EfNsehtem9f51xT6CTRRo3UHyxAAcbJtcsrKwBN0ta2eMbWyC5P-upK8saQuYjqLrb4As6w4PLJzlfzKJnIVEU4kI0lOQW-3H55pBHmIhpGWnx_CuuSQcom0XwB55D31xSVommy5mEb0tnjbEqnlgExEqaB7ThsEfcrerF2-QKu73yAxBrOyjY1LLrhBc9u8EFDUzQ2OzfVvAfL6nZ5fuTBWU2eD8AOzucvAMAvXLfbW0rM2xx6hdDH8w_AiNJw62D3WLkOZjPWO6CA7Y-aGhQS9Lz7vIgngKVxOuaM_ZlUoAQPxlxZtTUbbZFdHzSHac9BjkEaczUHf-rkeweByqXa9LsQAdc-kN_UKHmzCIEMkNct90PtYcB4Qixx0N3tObnqaOoEK83vQV_J6zmZqmi_LBSqJmgx7AK_cbd3Pl4Ee5UXSBq9X1DH8aBqP3aTlsbjzBmusGfKKUZPlw-aP73VSEsvsooj92F45eI-4XMO-WxXfgojDE4gmZnpLNAtu6_bq2C_sp3r8cyStqtHVeqD1pjQO23If3_-JYhyaeogV090X23CManR08hvt0s7oB_nUeDkPNVXPdiRD2LFsY-7MSQ0nx2NkK6yOm5DlV7Ge7Dgb7u8yqZTuIT3uCh85qgd6s_JeOYVzzANgQClfTK_qpUVYvfUiBOSjgxmyWXWypKB-kZFHi8VQaXNfFFyPYXQV6FWyzogeew0v77goyBmaO33Yjwtyz8cic0sHEgYghO5QnfdbF7T2-DAmBR988qWxHbGuUcGo4K85uB4-ilGyjosjgfGFjKmA88KmLzwK1G17zRSkKMTkJTmS1QksBXfo4eSB_AJTFPM8lnku-cu9Q5amyMYE5ffqhaO7KTU72CWuheu2VuQS_bGYTtnYpVgbG6wqy08PQLkvuJb5jvbVuaPy7NVSnSfjnJZiUtAOnHlANVFvbu8CS3xrHeQgb24n_SFtJe-bSz9crlR26-nQNY_e08DooBT4cZBIL18igdqzmMm7vb0RQ9bD7acUH12IJra8AUReqEg8jaoOyrM/wp/0.000504

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1652202015&bdh=VWeXh0Xtj096MZbFe0CPCe0PlYk.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=324522425&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssNrDuy3ORt4XPp2vF5omIKdva7-tRMjWNw_1ktUeAov2JAn0M8WnjMAlwSWMcOvnvwlVlNXJoGP5NVgWK8SobU55sLWQI7CVLwn-TqHlmLM6eTDVHCks2QRzDn2bANEeHtRFL1NWiGXtLbkBUHORNECcQNyB5Pz-Nv3RzX4d1jLp9AU272sd-l1IChV93smJy8XZrlDjwq70uKC1BAHCTRY6aqpWIwzlIV9frVtZGcm3S9U7mCKT6pc1KMa_XNWudy38sAZsu6DoOXGJkg4IGeMK84TFFDRXH0L7nZ2TVRgzZm1V1Jg7OuLGEMXl9kkgR-DE84XNYVC-a0b6edMEingg%2526sai%253DAMfl-YQsB3PmL__RNSsN9p-DDLac6bPjmsHdmnQuN57bdkciH6L-eKi73ldRYmy_gNz8GCN5kdPHEcErS687rkbDIwCA1LF0zlSZ-wyyYcbF_blsCO74teRtQ1qOmNOFCG0%2526sig%253DCg0ArKJSzEoQSuM5vYOKEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

c760eb3eb05a3985c3b0aaa110313f21cc89df503ed5c92e6646c5795fe5a97e

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:16 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: text/javascript
x-xss-protection: 1; mode=block
expiry: Thu, 01 Jan 1970 00:00:00 GMT
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
strict-transport-security: max-age=15552000
content-length: 2887
x-content-type-options: nosniff

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame E007 0
819 B 16ms
15ms Image
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLzCfBM8wQAAAMA1gAFAQigtOqTBhDKpbnGn-28rXYY6YKysa-ApeE9KjYJ9SP_eZOCQD8R7p_-j4VqOj8ZAAAAIIXrsT8h7p_-j4VqOj8p9SMJJNgxAAAAQOF6hD8w44L0CDjKQUCfF0i3AVCkydaqAViY1VJgAGjr3JoBeKCPBYABAYoBA1VTRJIBAQbwQJgB2AWgAVqoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAZoFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlCQ4sbmV0JTJGcGNzJTJGBRIcJTI1M0Z4YWkBCPQABERBS0FPanNzTnJEdXkzT1J0NFhQcDJ2RjVvbUlLZHZhNy10Uk1qV053XzFrdFVlQW92MkpBbjBNOFduak1BbHdTV01jT3ZudndsVmxOWEpvR1A1TlZnV0s4U29iVTU1c0xXUUk3Q1ZMd24tVHFIbG1MTTZlVERWSENrczJRUnpEbjJiQU5FZUh0UkZMMU5XaUdYdExia0JVSE9STkVDY1FOeUI1UHotTnYzUnpYNGQxakxwOUFVMjcyc2QtbDFJQ2hWOTNzbUp5OFhacmxEandxNzB1S0MxQkFIQ1RSWTZhcXBXSXd6bElWOWZyVnRaR2NtM1M5VTdtQ0tUNnBjMUtNYV9YTld1ZHkzOHNBWnN1NkRvT1hHSmtnNElHZU1LODRURkZEUlhIMEw3bloyVFZSZ3pabTFWMUpnN091TEdFTVhsOWtrZ1ItREU4NFhOWVZDLWEwYjZlZE1FaW5nZyUyNTI2c2FpJTI1M0RBTWZsLVlRc0IzUG1MX19STlNzTjlwLURETGFjNmJQam1zSGRtblF1TjU3YmRrY2lINkwtZUtpNzNsZFJZbXlfZ056OEdDTjVrZFBIRWNFclM2ODdya2JESXdDQTFMRjB6bFNaLXd5eVljYkZfYmxzQ083NHRlUnRRMXFPbU5PRkNHMCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFb1FTdU01dllPS0VBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQDYAgDgAp_wP-oCFmh0dHBzOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqA0wSEjMyMTcwOTg2OTAxNjE1NDU3NhoTODUyODM5NjQ4MDg1MDg0MjMxNCIJMzU3OTM0MjQ0Kg1PQVRIMTAzMjcwMDAwOgc0NzQ1ODkzwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEpMnWqgGIBQGYBQCgBcXUjKHr682oc8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBc-gTvoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbolgPaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwcyMDc2NzM4ugcPCAAQABgAIAAwADi6BkAAyAegjwXSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB-z7A4oIAhAA&s=ef2ca863b3ccde195980aa4ddb233383213ebf8c

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1652202015&bdh=VWeXh0Xtj096MZbFe0CPCe0PlYk.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=324522425&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssNrDuy3ORt4XPp2vF5omIKdva7-tRMjWNw_1ktUeAov2JAn0M8WnjMAlwSWMcOvnvwlVlNXJoGP5NVgWK8SobU55sLWQI7CVLwn-TqHlmLM6eTDVHCks2QRzDn2bANEeHtRFL1NWiGXtLbkBUHORNECcQNyB5Pz-Nv3RzX4d1jLp9AU272sd-l1IChV93smJy8XZrlDjwq70uKC1BAHCTRY6aqpWIwzlIV9frVtZGcm3S9U7mCKT6pc1KMa_XNWudy38sAZsu6DoOXGJkg4IGeMK84TFFDRXH0L7nZ2TVRgzZm1V1Jg7OuLGEMXl9kkgR-DE84XNYVC-a0b6edMEingg%2526sai%253DAMfl-YQsB3PmL__RNSsN9p-DDLac6bPjmsHdmnQuN57bdkciH6L-eKi73ldRYmy_gNz8GCN5kdPHEcErS687rkbDIwCA1LF0zlSZ-wyyYcbF_blsCO74teRtQ1qOmNOFCG0%2526sig%253DCg0ArKJSzEoQSuM5vYOKEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 269b5ee0-9237-467f-b624-40d452ba66dd
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame E007 85 KB
29 KB 9ms
6ms Script
application/x-javascript 151.101.1.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1652202015&bdh=VWeXh0Xtj096MZbFe0CPCe0PlYk.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=324522425&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjssNrDuy3ORt4XPp2vF5omIKdva7-tRMjWNw_1ktUeAov2JAn0M8WnjMAlwSWMcOvnvwlVlNXJoGP5NVgWK8SobU55sLWQI7CVLwn-TqHlmLM6eTDVHCks2QRzDn2bANEeHtRFL1NWiGXtLbkBUHORNECcQNyB5Pz-Nv3RzX4d1jLp9AU272sd-l1IChV93smJy8XZrlDjwq70uKC1BAHCTRY6aqpWIwzlIV9frVtZGcm3S9U7mCKT6pc1KMa_XNWudy38sAZsu6DoOXGJkg4IGeMK84TFFDRXH0L7nZ2TVRgzZm1V1Jg7OuLGEMXl9kkgR-DE84XNYVC-a0b6edMEingg%2526sai%253DAMfl-YQsB3PmL__RNSsN9p-DDLac6bPjmsHdmnQuN57bdkciH6L-eKi73ldRYmy_gNz8GCN5kdPHEcErS687rkbDIwCA1LF0zlSZ-wyyYcbF_blsCO74teRtQ1qOmNOFCG0%2526sig%253DCg0ArKJSzEoQSuM5vYOKEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.1.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:16 GMT
Content-Encoding: gzip
Age: 6508904
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29216
X-Served-By: cache-lga21974-LGA, cache-hhn4062-HHN
Access-Control-Allow-Origin: *, *
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
X-Timer: S1652202016.319124,VS0,VE0
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 24 Feb 2023 08:58:29 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 386514, 3463716

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2EDA 143 B
163 B 39ms
39ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3210
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 16:06:46 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0A64 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fbd168c70e6e336e05bbbbf8041fb71fefc170639ce62c32f36ab4541fdff63f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 12C2 0
843 B 34ms
34ms Ping
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL7CvBMewUAAAMA1gAFAQigtOqTBhCIhsjL2riSiQEY6YKysa-ApeE9KjYJkQw5tp4hjD8RdHD6xEuBhj8ZAAAA4FG4rj8hdHD6xEuBhj8pkQwJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3NaMFhkV2dzeWo5ZFIzaU1ldWZnVWhwdXpXbG9PRU1tU2NhOVpYSEJab2RrZmxTMTBiRzA3ZlRpLVM3NXFnMnkyQm4xaUtuQ1VYelRhcDdIZ2I3WkRydHdnUjE2R0Q0VHdRWVpxaFp1amZEeVlZT0NhZWcyYXZ5LXY5TWR5YmMwbVlDN3ZXenVWc1ZndHFhZTZiOTdmTnluUGRBRUozTENDOVVUR2Z1MHNqMFhuQUVmek1LUEh5ajFvbThKeHNFUkR6MnlqaHo4TVR3M0owZURzNnhEN1R4bTA3RDcwNVZhb01sSjROaDRob0hTdTctdEZqd0FqSTFJaTdBS2hiLTk0ZXlHTFhiUnAxN0hZekVDNkZCdXZxLUVEMnVfVFVyQTh2ZnVhNlotOXlHdHdrcDFWSERDYzlGeXQ5YXRMN2pCa2dMT3d6JTI1MjZzYWklMjUzREFNZmwtWVR5RUp3SHRfTmpfRnM3UVBSYWVDNkZkczJRaHllZlVvc2VhbjVRUW1BTEVPVHBUQUdDbjVDTW9xNGlaVkpUUDA3TVpWX1I0WjV5LWRQM3RCellkX19aUGxERWgwY05lb3dkN3pDNU4ySUlxQjBMVENpOW5GYVJhbF9aZldRJTI1MjZzaWclMjUzRENnMEFyS0pTekJyS3p6aF95N0hGRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGWmDovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPoAQq_AREsYHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24FPAkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQjExTUotZVRDVU5YOWV3WFBrUEhLaWlnSXJlcG90TjhNMzhDc1JlQXRlNEU2U0dvZDczT1J5MGctVUNzTW1scEMyeGItTmo5OGxzbVNmMXl2N3BhWjQ0VHN3dncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoRNzcyMDUyNTY5MTg5MjYwODgiCDc3MjIxNzkzKgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFvo_Qm5TSwKN0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAkzGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM0NTk1MTU5MzU5ugcPCAABKTwgADAAOLoGQADIBwDSBw0JEUcBHAjaBwYJJUTgBwDqBwIIAPAH7PsDiggCEAA.&s=3ca404d624cd415e2591fffedd558225f1185fdd&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=8305335281848419804&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 3ca5cd63-b27a-4434-84eb-4343b3a3d120
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://ams1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 42CF 84 KB
32 KB 97ms
95ms XHR
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc845d99cafe15b8c580cb736da59dede74bc11bf221746feca797d0981720bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 10 May 2022 17:00:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32722
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2EDA
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

138ms
137ms

Document
text/html

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 17:00:16 GMT
expires: Tue, 10 May 2022 17:00:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 17:00:16 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v44/ Frame 0A64 28 KB
28 KB 130ms
41ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v44/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 22:13:40 GMT
x-content-type-options: nosniff
age: 585996
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28276
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:33:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 03 May 2023 22:13:40 GMT

GET
H2 200 inside.js Show response
cdn.js7k.com/rq/iv/ Frame E007 43 KB
14 KB 115ms
21ms Script
application/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.js7k.com/rq/iv/inside.js

Requested by

Host: pr.ybp.yahoo.com
URL: https://pr.ybp.yahoo.com/ab/secure/true/crid/7Bq29K0sEDsTVvCIAEgYMDfZxWqJLL3z/imp/OBOPIQFLxjwN4Y4iV56kf8WyDvupd99kd1lNlw3xCrUWUWDf64tPaZaly2j0gm6xGPZ6forp7AiqdbyihWEtwX_MBa5vWD7ugmsmz9kd4BRojydx8QGzw5qt32KeVnKhA-F5ubvUsMpViMw38OgPnn1aIQSFbFRPUECFUKaDoLudsFbsL4fJAJXaFE8Igyk__tKmWOBa-tuc7O4OeDeIOyuiNLZFdEplJq2Q3rceMbWlZwIKLg7K1t6oMeBpsUyo4ou50zqstXqf9FIijH5QTl8qVfgj7mr0O5_3xEAq7xcG23C0xfIPB3WYKdvjx0RDkBt0Cc20K3sFaCaA1wV3EfNsehtem9f51xT6CTRRo3UHyxAAcbJtcsrKwBN0ta2eMbWyC5P-upK8saQuYjqLrb4As6w4PLJzlfzKJnIVEU4kI0lOQW-3H55pBHmIhpGWnx_CuuSQcom0XwB55D31xSVommy5mEb0tnjbEqnlgExEqaB7ThsEfcrerF2-QKu73yAxBrOyjY1LLrhBc9u8EFDUzQ2OzfVvAfL6nZ5fuTBWU2eD8AOzucvAMAvXLfbW0rM2xx6hdDH8w_AiNJw62D3WLkOZjPWO6CA7Y-aGhQS9Lz7vIgngKVxOuaM_ZlUoAQPxlxZtTUbbZFdHzSHac9BjkEaczUHf-rkeweByqXa9LsQAdc-kN_UKHmzCIEMkNct90PtYcB4Qixx0N3tObnqaOoEK83vQV_J6zmZqmi_LBSqJmgx7AK_cbd3Pl4Ee5UXSBq9X1DH8aBqP3aTlsbjzBmusGfKKUZPlw-aP73VSEsvsooj92F45eI-4XMO-WxXfgojDE4gmZnpLNAtu6_bq2C_sp3r8cyStqtHVeqD1pjQO23If3_-JYhyaeogV090X23CManR08hvt0s7oB_nUeDkPNVXPdiRD2LFsY-7MSQ0nx2NkK6yOm5DlV7Ge7Dgb7u8yqZTuIT3uCh85qgd6s_JeOYVzzANgQClfTK_qpUVYvfUiBOSjgxmyWXWypKB-kZFHi8VQaXNfFFyPYXQV6FWyzogeew0v77goyBmaO33Yjwtyz8cic0sHEgYghO5QnfdbF7T2-DAmBR988qWxHbGuUcGo4K85uB4-ilGyjosjgfGFjKmA88KmLzwK1G17zRSkKMTkJTmS1QksBXfo4eSB_AJTFPM8lnku-cu9Q5amyMYE5ffqhaO7KTU72CWuheu2VuQS_bGYTtnYpVgbG6wqy08PQLkvuJb5jvbVuaPy7NVSnSfjnJZiUtAOnHlANVFvbu8CS3xrHeQgb24n_SFtJe-bSz9crlR26-nQNY_e08DooBT4cZBIL18igdqzmMm7vb0RQ9bD7acUH12IJra8AUReqEg8jaoOyrM/wp/0.000504

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

1b3f1a6337f21366cf59487bb664dd0983c245ccf100be143f4366a07e005d09

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 13:57:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10997
x-amz-server-side-encryption: AES256
vary: Origin, Accept-Encoding
content-length: 14353
x-amz-id-2: Tn/21LATwyAjsBBLmWQUVqZVcjxbGMdqlbO3SsharJnd1hn+npqwz7+Ip/Z0WvDATo9nzZ3D8Vw=
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 09 Sep 2021 15:05:50 GMT
server: ATS
etag: "8ceeaab271ed688991789ed1090cb398-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 7CX33WPQWTFKG8JX
x-xss-protection: 1; mode=block
cache-control: public,max-age=14400
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 9ef95257-b768-4f1e-a37b-e510aaccc71c.png
s.yimg.com/ch/ Frame E007 69 KB
69 KB 200ms
23ms Image
image/png 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/ch/9ef95257-b768-4f1e-a37b-e510aaccc71c.png

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

4bb6c5cd39c6fa475168e74b2f28049032c587cc3d5cb12c2bf897781c51b191

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 09 May 2022 10:58:50 GMT
x-content-type-options: nosniff
age: 108087
x-amz-server-side-encryption: AES256
vary: Origin
content-length: 70298
x-amz-id-2: Js9E92FVx+utiyj6XgQ9cfj22Mh5s9jZNRjkEBNUY9Xvi1cMFZb+WHqFXTXUbmKHy7q3yJ1/rNU=
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 06 May 2022 16:46:38 GMT
server: ATS
etag: "d40d80e0308ade2b0117cba6abfd183e"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 0JP8MRKBHBQNV9SX
x-xss-protection: 1; mode=block
cache-control: max-age=15552000, public
x-amz-version-id: null
accept-ranges: bytes
content-type: image/png

GET
H2 200 adchoicesblue.png
s.yimg.com/ch/icons/adchoices/ Frame E007 565 B
852 B 197ms
22ms Image
image/png 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.yimg.com/ch/icons/adchoices/adchoicesblue.png

Requested by

Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b8954ed878ae615531f62b8d9a95a79d9a86a84f4af1504bcbec32d8e62d7ebd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

ats-carp-promotion: 1
date: Fri, 08 Apr 2022 06:53:40 GMT
x-content-type-options: nosniff
age: 2801198
x-amz-server-side-encryption: AES256
vary: Origin
content-length: 565
x-amz-id-2: vxmyugx+WunPR6p7lkpCw4UU2XkDBNA+1ZJ9WU8ihYOG/UIOpOjjEhQsLSWxDaa4aEIf2/kvnpQ=
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 22 Jul 2020 18:15:42 GMT
server: ATS
etag: "349bad1100a940608cb9109eb2b166a2"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
x-amz-request-id: 7PPF3327AE4KE8B7
x-xss-protection: 1; mode=block
cache-control: max-age=15552000, public
x-amz-version-id: null
accept-ranges: bytes
content-type: image/png

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/ Frame 42CF 25 KB
10 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36998456859e35cf76812894575b0203d48ad8ac11d3165c5449d1fa73f19800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:55:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9783
x-xss-protection: 0
server: cafe
etag: 9821519945299111448
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:55:17 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/ Frame 42CF 3 KB
1 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b59e198c356c79d1ba89670c50cdb7e54181037f277ee106126caf570278bc11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:49:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 641
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1432
x-xss-protection: 0
server: cafe
etag: 15450667304708860052
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:49:35 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 42CF 120 KB
37 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfaf60508a77b732490cebbf93a415622f5d33fc0a63f88365807b71a21c25b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37409
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1652096384767712"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 10 May 2022 17:00:16 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/ Frame 42CF 19 KB
8 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e2268bde09038607e2997012b5d696ce68013a1fdd96e646bb03890b98f73d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 16:49:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 672
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7673
x-xss-protection: 0
server: cafe
etag: 8553123382206257723
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 24 May 2022 16:49:04 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 42CF 0
0 51ms
51ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRwdwe3DkEqPX4e81rSwXfVg8yDV_SMpAW2DN_wZAAtvC0a3YLaRtDko76_J--03HuGfr9wFwwsDcPil81F2D6JnNKqHw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma.js Show response
tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/ Frame 42CF 39 KB
15 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220509/r20110914/client/one_click_handler_one_afma.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

10292ce32f4f0fd7da110ee891b1469b0a933587e90f86c17cd9c6f6b8aee842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 09 May 2022 19:45:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15112
x-xss-protection: 0
server: cafe
etag: 599080869511108166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 23 May 2022 19:45:24 GMT

GET
H3 200 6277983113945969527
tpc.googlesyndication.com/simgad/ Frame 42CF 33 KB
33 KB 57ms
57ms Image
image/png 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6277983113945969527?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qlvwzqH-O81riAY1JqOpMUyLcTCug

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9eaec8e4ae9d640ac4c96c81bd2266527b6d21cb01256d99e304e4f5fc2e11e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Fri, 06 May 2022 16:07:43 GMT
x-content-type-options: nosniff
age: 348753
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34269
x-xss-protection: 0
last-modified: Fri, 06 May 2022 15:48:58 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 06 May 2023 16:07:43 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 42CF 0
17 B 82ms
81ms Image
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CpzgtIJp6Yp7_BtaUgQeR8Yo4v_mB7mmN3PmA3g-_4R4QASDml9YlYJXikIKgB6ABm4jRnwPIAQKpAnSt0hposLE-qAMByAPJBKoEzwFP0BZLLXoBa2DWWd7o4wgm2SjeLIEbLa-WN4K9VnlRrZboVlSNOiCtNWIFuAmtsFsFgJrK8RwccOWVdW8uGIw59gGuVtaqPqi9hnxg5_fV14siqWJ1jaH1Ryv83RAwOuVWTc7CzXb02IqK85-vuTDiI6JycKnq43NvgRc_8qBgBzON9sT4AOobxQ-7o9-QNFzUNvf65eAhv7sUh--p3LG9k77MtLYOsff7cKud1Al5-_YOHjCVSHT7n2-6YjBwcWPLQWnTyIDsmWfeP6tcQODABL_K_LP1A5IFBAgEGAGSBQQIBRgEoAYCgAfN965gqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHSCAkIgOGAEBABGADyCA5iaWRkZXItMzA1NjQ0N4AKBMgLAdgTDNAVAZgWAYAXAbIXCAoGCAASABgA&sigh=2tFr0HLkeHE&uach_m=[UACH]&pr=10:0.013736&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Tue, 10 May 2022 17:00:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0C21 143 B
163 B 41ms
40ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3210
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 16:06:46 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 42CF 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d54e4af071fab78ecf4ee071eddaee6197f327064eee5ea281517b4aaee74aa1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame DB3F 52 KB
17 KB 8ms
7ms Document
text/html 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: 3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
URL: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 10 May 2022 17:00:16 GMT
ETag: "623de86a-cf34"
Expires: Wed, 11 May 2022 17:00:18 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame E007 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fd20c943b63470912467d93e69792078f298dc4cf1712fefc9f73d57b997275b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame E007 0
890 B 14ms
14ms Ping
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLzCfBM8wQAAAMA1gAFAQigtOqTBhDKpbnGn-28rXYY6YKysa-ApeE9KjYJ9SP_eZOCQD8R7p_-j4VqOj8ZAAAAIIXrsT8h7p_-j4VqOj8p9SMJJNgxAAAAQOF6hD8w44L0CDjKQUCfF0i3AVCkydaqAViY1VJgAGjr3JoBeKCPBYABAYoBA1VTRJIBAQbwQJgB2AWgAVqoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAZoFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlCQ4sbmV0JTJGcGNzJTJGBRIcJTI1M0Z4YWkBCPQABERBS0FPanNzTnJEdXkzT1J0NFhQcDJ2RjVvbUlLZHZhNy10Uk1qV053XzFrdFVlQW92MkpBbjBNOFduak1BbHdTV01jT3ZudndsVmxOWEpvR1A1TlZnV0s4U29iVTU1c0xXUUk3Q1ZMd24tVHFIbG1MTTZlVERWSENrczJRUnpEbjJiQU5FZUh0UkZMMU5XaUdYdExia0JVSE9STkVDY1FOeUI1UHotTnYzUnpYNGQxakxwOUFVMjcyc2QtbDFJQ2hWOTNzbUp5OFhacmxEandxNzB1S0MxQkFIQ1RSWTZhcXBXSXd6bElWOWZyVnRaR2NtM1M5VTdtQ0tUNnBjMUtNYV9YTld1ZHkzOHNBWnN1NkRvT1hHSmtnNElHZU1LODRURkZEUlhIMEw3bloyVFZSZ3pabTFWMUpnN091TEdFTVhsOWtrZ1ItREU4NFhOWVZDLWEwYjZlZE1FaW5nZyUyNTI2c2FpJTI1M0RBTWZsLVlRc0IzUG1MX19STlNzTjlwLURETGFjNmJQam1zSGRtblF1TjU3YmRrY2lINkwtZUtpNzNsZFJZbXlfZ056OEdDTjVrZFBIRWNFclM2ODdya2JESXdDQTFMRjB6bFNaLXd5eVljYkZfYmxzQ083NHRlUnRRMXFPbU5PRkNHMCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFb1FTdU01dllPS0VBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQDYAgDgAp_wP-oCFmh0dHBzOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqA0wSEjMyMTcwOTg2OTAxNjE1NDU3NhoTODUyODM5NjQ4MDg1MDg0MjMxNCIJMzU3OTM0MjQ0Kg1PQVRIMTAzMjcwMDAwOgc0NzQ1ODkzwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEpMnWqgGIBQGYBQCgBcXUjKHr682oc8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBc-gTvoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbolgPaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwcyMDc2NzM4ugcPCAAQABgAIAAwADi6BkAAyAegjwXSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB-z7A4oIAhAA&s=ef2ca863b3ccde195980aa4ddb233383213ebf8c&type=nv&nvt=5&jm=1140|1141|1003&px=0&py=0&bw=728&bh=90&sid=7057841341432276688&vd=ct~0|rr~0&sv=224&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=728&ph=94&ww=728&wh=90&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6759d84e-c8fa-4a7b-85fa-fc3cb6477e30
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame E007 0
0 74ms
74ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstpqNf0CpVC9py6A0TtAmjHMCLKGx_fXVE7VyZCjbIdHxZ51IAVRJYVLwo7wk1wWAzFtecHNQJZPmorZMlgzVa9DZgsbVC-l-a9NFpPmTcWCH3tEAEu9wtycTFXZySetiqCa7R3ObgC1W7UFky80jmlwezTyxTZ4OnDeYbJKVgSEcZ8_Ijo9pRQ86kxS9bHS5jIFOZG93HNKV0j_21ucyHtyO2uJs9Ps8X11DyWvesSPe54urgeN8Lx-kXdF1JlQxh0XvGxVHjyYTcagHdDiFWAkz0ElJDDUPeA4JsJkBZChnVOGYhHLWi-2u2cju746ICC6CQPL69q8qnkwxrFhI791g82-rKs&sai=AMfl-YQH9YW7VHZVEE07MJ_2D_fAo9XeehgclpqSS1DhxwDynfvasZAlidSRdyYDiq6ROzlJ5dTb54NuTwao3GsyWWD9jMjze0X5bpCUwDgA_kRxkjiPWJmvtAHgpD_7ehQ&sig=Cg0ArKJSzF2kW_WLJ5tIEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 10 May 2022 17:00:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Tue, 10 May 2022 17:00:16 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 80ms
79ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022050501&jk=4440442240957361&bg=!enmleT3NAAZX5TVhd-U7ACkAdvg8Wr6vmJYcO7MqNuaf80_ikLTSO6NIsOObRrWBFoYy5vs1wGmrdQIAAABZUgAAAAJoAQeZAqQcY-GrJhfDSdr1b0ElSk_sAsJQC-AoLYGSnIbZETdiS9M8CixTc3-QIOAZCuyAXgJpV4-sfItlO37ccPl_jCQn_7awc2-Qh8oGzYBNSeHCdWraqTYVPQdAmbySRzc_P8-oEYY2etX-xH4MPhY-ZomwKTdPPudRFeKKzxkQL39aQuIelfwL-iBI3EOrAhckLX81PdknIaUrLczZz_TFeKDj2DQdhcVuvO_ooHJvxkOKq1ZlWfbU-_towArQ74lnZ9HmXlTKXjZjpE1MHuEPK98eCGZ_crTxJUKtyKvhu-yoCR8X8SwFuMD51nm2FHQJIs9sjp2Ww-LOc604WpX7qkbTm_66NMBG7iCm5ISKiMdCyGHrFGSZ1Out9inlHm-y-6UfXkFFP9u40X8k48EOq-KtgTsjXhugFwof__tQsHB00zrB1wxzJjj1E_NR2lJzpA1DghIsH2Fa1bU3wRg3NPnuuCD87151NEnUbETbDs8fazviS544c7m5pdL1mfXEOVDa8NinxWponePm-MjrkIcEl7d-rWmpRv3miQoCw_cxtyDxWVH7KfGfVMqEt_JltViLyPIPbrjFIDooxgwbwA48dZAZQjBPIn4_eEmwr_VbBshkEJPHENGEFLu1pCjfsC_uuF8qbqBBnPg-5SzEFfuk29jG105S5hO6wHRfABEyP7NQI6pMWo0T81y2Xn6Ycz6o1gib_tC5mUkatz424pTYDAD1uMf5vpJgYNZjzsk1P2XIg7gRy6ZQvgXVuBmsVfC06XdORZ2GllwkbVM7jlkghoie5BWsh4SpXtkhvH7IUHJLM2A40hSgnYNhINrdO9qdPgPGiNjIG3DBvARpv0X3sN51FWMtxCZUWq5XsnCon1cYBVxCCgUAAYDVs95YHUHQV5Re
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0C21
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

117ms
116ms

Document
text/html

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 17:00:16 GMT
expires: Tue, 10 May 2022 17:00:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 17:00:16 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C68 35 KB
13 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea4019076476224330f3b3f4fa21af893f81abf9e80cb924911e8186167d9042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 15:57:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3753
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13523
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 10 May 2023 15:57:43 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DB3F 0
747 B 13ms
13ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:16 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 26531cb5-d358-4c7f-85f5-0b8be413ba4a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js Show response
pagead2.googlesyndication.com/bg/ Frame 06C8 35 KB
13 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/6kAZB2R2IkMw87P0-iGviT-Bq_noDLkkkR6BhhZ9kEI.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20222514356/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea4019076476224330f3b3f4fa21af893f81abf9e80cb924911e8186167d9042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 15:57:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3753
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13523
x-xss-protection: 0
last-modified: Mon, 02 May 2022 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 10 May 2023 15:57:43 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EA4A 42 B
64 B 145ms
70ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssuIuclZcGONOgXyBoiI0a8fj8EnDsZ-GRn2JyniOVk25yOIhMIFzlp-4rJGgakk6qpN8MpWVaW6S67WCQm6_hRD32-JDDanl8F4AuGt0jBnqVi1xm6&sig=Cg0ArKJSzCV5j9VAKuK0EAE&id=lidar2&mcvt=1014&p=950,1091,1200,1391&mtos=1014,1014,1014,1014,1014&tos=1014,0,0,0,0&v=20220509&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3809685794&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652202015666&rpt=201&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 665C 0
839 B 21ms
20ms Ping
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F&e=wqT_3QKLBsgLAwAAAwDWAAUBCJ-06pMGEKGxg8rvjYqsfhgAKjYJ8lt0stR6nz8RwnzDjhAvmT8ZAAABAgzoPyHCDRIAKREkyDEAAADgUbiePzD17bMLOMpBQOUeSGVQp6LLJViY1VJgAGjP-Gt4iugFgAEBigEDVVNEkgUG9BMCmAHYBaABWqgBAbABALgBAcABBcgBAtABANgBAOABAPABANgCAOACn_A_6gIoaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjIyNTE0MzU2L4ADAIgDAZADAJgDF6ADAaoD6gEKvwFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmF3YmlkX2I9QUtBbWYtQ00yMHBVMTh6S3cwMUN4ODktV1pHMlZGUEFmRkZBWFFfSVZZbV9xN0s2NktIampWbzNfc1dNcWJiVmNHRmlsZVpUdTRmd2RIZ0JDb0J3UHVuMkVId3lWVEM0QUEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTOTEwNDA3MTEwMzgyMjc0NzgwOSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDzE4NS4yMTMuMTU1LjE2MqgEALIEDwgAEAEY2AUgWigAMAA4ArgEAMAEAMgEANoEAggB4AQB8ASnossliAUBmAUAoAX16q2TlanCiDvABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXMkCX6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAEFkGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTA2MTU3MTkyNzk2ugcPCAABKUQgADAAOLoGQADIB4roBdIHDQkRSQEeCNoHBgknROAHAOoHAggA8Afs-wOKCAIQAA..&s=d204a1774671768e7a970ea5d619bd4f233bcfe2&type=pv&jm=1003&px=436&py=474&bw=728&bh=90&sf=1&sid=1722182681031183046&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:17 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 10f2e81e-13d4-4b8e-b371-0c864808cb24
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame B819 42 B
64 B 70ms
69ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsubWEnWIPrbN4HwK-uAZAlfBFRqbWe_Ai7bP2t0tiVNdYsi__G2YIMOEwrthee1TUVuGqh5lGvSiubSY2LKwrYBL5BGpYoPfNUqtoVcBkDPBQRlCdtS&sig=Cg0ArKJSzFfJYfK18O2tEAE&id=lidar2&mcvt=1000&p=474,436,564,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220509&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652202015658&rpt=396&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CB21 42 B
64 B 70ms
70ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss5vX4r2vW7_DYkgSSdmhF9vEamL0Dhb_QMOnp6nJ6haQM7S18FdlPIym8UroaQ-Xpof2HVvd0IzybYgBydzUSHWKwFvc4ox3tlsS8GLgzNRsvd1_c0&sig=Cg0ArKJSzKpt_G5l3KZ8EAE&id=lidar2&mcvt=1000&p=666,1091,916,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220509&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652202015652&rpt=579&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame BD24 0
747 B 43ms
42ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:17 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 622b795b-7f41-4bc1-b5b9-73b45cbdc5c2
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 12C2 0
843 B 36ms
35ms Ping
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL7CvBMewUAAAMA1gAFAQigtOqTBhCIhsjL2riSiQEY6YKysa-ApeE9KjYJkQw5tp4hjD8RdHD6xEuBhj8ZAAAA4FG4rj8hdHD6xEuBhj8pkQwJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3NaMFhkV2dzeWo5ZFIzaU1ldWZnVWhwdXpXbG9PRU1tU2NhOVpYSEJab2RrZmxTMTBiRzA3ZlRpLVM3NXFnMnkyQm4xaUtuQ1VYelRhcDdIZ2I3WkRydHdnUjE2R0Q0VHdRWVpxaFp1amZEeVlZT0NhZWcyYXZ5LXY5TWR5YmMwbVlDN3ZXenVWc1ZndHFhZTZiOTdmTnluUGRBRUozTENDOVVUR2Z1MHNqMFhuQUVmek1LUEh5ajFvbThKeHNFUkR6MnlqaHo4TVR3M0owZURzNnhEN1R4bTA3RDcwNVZhb01sSjROaDRob0hTdTctdEZqd0FqSTFJaTdBS2hiLTk0ZXlHTFhiUnAxN0hZekVDNkZCdXZxLUVEMnVfVFVyQTh2ZnVhNlotOXlHdHdrcDFWSERDYzlGeXQ5YXRMN2pCa2dMT3d6JTI1MjZzYWklMjUzREFNZmwtWVR5RUp3SHRfTmpfRnM3UVBSYWVDNkZkczJRaHllZlVvc2VhbjVRUW1BTEVPVHBUQUdDbjVDTW9xNGlaVkpUUDA3TVpWX1I0WjV5LWRQM3RCellkX19aUGxERWgwY05lb3dkN3pDNU4ySUlxQjBMVENpOW5GYVJhbF9aZldRJTI1MjZzaWclMjUzRENnMEFyS0pTekJyS3p6aF95N0hGRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGWmDovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPoAQq_AREsYHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24FPAkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQjExTUotZVRDVU5YOWV3WFBrUEhLaWlnSXJlcG90TjhNMzhDc1JlQXRlNEU2U0dvZDczT1J5MGctVUNzTW1scEMyeGItTmo5OGxzbVNmMXl2N3BhWjQ0VHN3dncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoRNzcyMDUyNTY5MTg5MjYwODgiCDc3MjIxNzkzKgQzOTQxOgEwwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFvo_Qm5TSwKN0wAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFNPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAkzGQGgEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTM0NTk1MTU5MzU5ugcPCAABKTwgADAAOLoGQADIBwDSBw0JEUcBHAjaBwYJJUTgBwDqBwIIAPAH7PsDiggCEAA.&s=3ca404d624cd415e2591fffedd558225f1185fdd&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=8305335281848419804&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:17 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 848012f5-6923-4f76-9f9c-5aafd5b154af
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://ams1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 60ms
28ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0413c66952464f1ecd016f7bcaab521634a380fc3f9b1b907caa11cb70c2ebc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:17 GMT
content-encoding: gzip
last-modified: Tue, 03 May 2022 11:21:00 GMT
server: nginx
etag: W/"6271101c-15b58"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 11 May 2022 17:00:17 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 9838 14 KB
6 KB 16ms
15ms Document
text/html 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

67b5149e118833c325f62559db1efb40d9047c5f6ea3e8e12685e28a2545f717

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-length: 5883
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 10 May 2022 17:00:17 GMT
server-processing-duration-in-ticks: 1741
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 57ms
27ms XHR
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0413c66952464f1ecd016f7bcaab521634a380fc3f9b1b907caa11cb70c2ebc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:17 GMT
content-encoding: gzip
last-modified: Tue, 03 May 2022 11:21:00 GMT
server: nginx
etag: W/"6271101c-15b58"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 11 May 2022 17:00:17 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 42CF 42 B
64 B 76ms
76ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsve0tt5MmEinkf32mTGuEXTGDXpJEzW6fTJP1EIt2N2r4vyaMkku2V2aVrtaZnKeQOuE3G0S1uvEK1rBoI4-GLOx8HXTnYCxsY94A8jutoFXR3PGzrM36dwD-Dh&sig=Cg0ArKJSzKjNkhGi9TW0EAE&cid=CAASF-Ro8q_r0S0o3bdgrFaDBRLKrJ3761V7&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220509&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=2938260542&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652202016309&rpt=293&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 9838
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1&topicsavail=0
https://mug.criteo.com/sid?cpp=SH7hjHxOQW1rN1F2dVEza01wK3VQclI4SklxQnZuc0MyZ1RmQ3JPc3Y4Y000T0FpT1RGOHJxZHlaK3RLWCthN25oODBWelZhMGdQd2NqVGpFNTloMUQybWRTMmdkU0psODhsaE1WRHFCcWVmSzAreWYwYUIrK1E3c0hQUW...

435 B
632 B

93ms
17ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=SH7hjHxOQW1rN1F2dVEza01wK3VQclI4SklxQnZuc0MyZ1RmQ3JPc3Y4Y000T0FpT1RGOHJxZHlaK3RLWCthN25oODBWelZhMGdQd2NqVGpFNTloMUQybWRTMmdkU0psODhsaE1WRHFCcWVmSzAreWYwYUIrK1E3c0hQUWxUdnV1Y2JOQ29GVXB6Vm9HQlJhZWZadnBnUVVTZ3ZkcDg2YnRXK1N3OFNNREJNaEcxL3I4dmIwbDB6bDhyUU1mSEJjUjRjenAzSmRRakdKQXlTaW1Gb0NJRWNYcW1FT1NSTDRoTUZnYTU5SHhqQURhVXZkMXZxMW9LQzc5YmdIemFmVGtnOStRSmJ2T1FJSVI3N2dCemIyQmh2eUowdz09fA&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

625a82aab5c808ed1575628f9ca3cfa96b7f7bd1774f7b3edd2f75e69aa6075f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:16 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 4566
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:17 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=SH7hjHxOQW1rN1F2dVEza01wK3VQclI4SklxQnZuc0MyZ1RmQ3JPc3Y4Y000T0FpT1RGOHJxZHlaK3RLWCthN25oODBWelZhMGdQd2NqVGpFNTloMUQybWRTMmdkU0psODhsaE1WRHFCcWVmSzAreWYwYUIrK1E3c0hQUWxUdnV1Y2JOQ29GVXB6Vm9HQlJhZWZadnBnUVVTZ3ZkcDg2YnRXK1N3OFNNREJNaEcxL3I4dmIwbDB6bDhyUU1mSEJjUjRjenAzSmRRakdKQXlTaW1Gb0NJRWNYcW1FT1NSTDRoTUZnYTU5SHhqQURhVXZkMXZxMW9LQzc5YmdIemFmVGtnOStRSmJ2T1FJSVI3N2dCemIyQmh2eUowdz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1794
content-length: 541
expires: 0

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame E007 0
890 B 15ms
15ms Ping
text/html 185.33.221.50
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLzCfBM8wQAAAMA1gAFAQigtOqTBhDKpbnGn-28rXYY6YKysa-ApeE9KjYJ9SP_eZOCQD8R7p_-j4VqOj8ZAAAAIIXrsT8h7p_-j4VqOj8p9SMJJNgxAAAAQOF6hD8w44L0CDjKQUCfF0i3AVCkydaqAViY1VJgAGjr3JoBeKCPBYABAYoBA1VTRJIBAQbwQJgB2AWgAVqoAQGwAQC4AQLAAQXIAQLQAQDYAQDgAQDqAZoFaHR0cHMlM0ElMkYlMkZhZGNsaWNrLmcuZG91YmxlCQ4sbmV0JTJGcGNzJTJGBRIcJTI1M0Z4YWkBCPQABERBS0FPanNzTnJEdXkzT1J0NFhQcDJ2RjVvbUlLZHZhNy10Uk1qV053XzFrdFVlQW92MkpBbjBNOFduak1BbHdTV01jT3ZudndsVmxOWEpvR1A1TlZnV0s4U29iVTU1c0xXUUk3Q1ZMd24tVHFIbG1MTTZlVERWSENrczJRUnpEbjJiQU5FZUh0UkZMMU5XaUdYdExia0JVSE9STkVDY1FOeUI1UHotTnYzUnpYNGQxakxwOUFVMjcyc2QtbDFJQ2hWOTNzbUp5OFhacmxEandxNzB1S0MxQkFIQ1RSWTZhcXBXSXd6bElWOWZyVnRaR2NtM1M5VTdtQ0tUNnBjMUtNYV9YTld1ZHkzOHNBWnN1NkRvT1hHSmtnNElHZU1LODRURkZEUlhIMEw3bloyVFZSZ3pabTFWMUpnN091TEdFTVhsOWtrZ1ItREU4NFhOWVZDLWEwYjZlZE1FaW5nZyUyNTI2c2FpJTI1M0RBTWZsLVlRc0IzUG1MX19STlNzTjlwLURETGFjNmJQam1zSGRtblF1TjU3YmRrY2lINkwtZUtpNzNsZFJZbXlfZ056OEdDTjVrZFBIRWNFclM2ODdya2JESXdDQTFMRjB6bFNaLXd5eVljYkZfYmxzQ083NHRlUnRRMXFPbU5PRkNHMCUyNTI2c2lnJTI1M0RDZzBBcktKU3pFb1FTdU01dllPS0VBRSUyNTI2ZmJzX2FlaWQlMjUzRCUyNTVCZ3dfZmJzYWVpZCUyNTVEJTI1MjZ1cmxmaXglMjUzRDElMjUyNmFkdXJsJTI1M0TwAQDYAgDgAp_wP-oCFmh0dHBzOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqA0wSEjMyMTcwOTg2OTAxNjE1NDU3NhoTODUyODM5NjQ4MDg1MDg0MjMxNCIJMzU3OTM0MjQ0Kg1PQVRIMTAzMjcwMDAwOgc0NzQ1ODkzwAOsAsgDANgDAOADAOgDAPgDAYAEAJIEBC90dGqYBACiBA8xODUuMjEzLjE1NS4xNjKoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEpMnWqgGIBQGYBQCgBcXUjKHr682oc8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBc-gTvoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbolgPaBhYKEAAAAAAAAAAAAAAAAAAAAAAQABgA4AYB8gYCCACABwGIBwCgBwGqBwcyMDc2NzM4ugcPCAAQABgAIAAwADi6BkAAyAegjwXSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB-z7A4oIAhAA&s=ef2ca863b3ccde195980aa4ddb233383213ebf8c&type=pv&jm=1140|1141|1003&px=0&py=0&bw=728&bh=90&sf=0.81&sid=7057841341432276688&vd=ct~0|rr~5&sv=224&tv=view7-1js&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.50 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:17 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 728.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 46ee63b5-70c6-4826-86b3-c1f75f3711ec
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E007 42 B
64 B 69ms
69ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuZacZf2pPp5-ZATP4K3re_tEulX-xWfxys8y1DNEyAI0GAug-HLIhpjht3F5YBIeNLj9H9rX4Tb1xUV2xvK1uCPE8Zg6OQc_sBrsHVHBpwwIqAkNH4&sig=Cg0ArKJSzGW-EqnADsa1EAE&id=lidar2&mcvt=1000&p=1127,276,1221,1004&mtos=0,1000,1000,1000,1000&tos=0,1000,0,0,0&v=20220509&bin=7&avms=nio&bs=0,0&mc=0.78&if=1&vu=1&app=0&itpl=19&adk=3878002045&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652202015656&rpt=1052&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 yv
beap-bc.yahoo.com/ Frame E007 43 B
306 B 60ms
48ms Ping
image/gif 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://beap-bc.yahoo.com/yv?sek=321709869016154576:1652202016124&as=YAMPViewableImpressionPayload&av=2.19.0&kv=0&ea=1&ap=-QvEJQyfpll4ErtgmpZs-TEPjNIEMvm4z632zr5sm0JEuvPXikvDhijeLXlYDPyPl4Ynnyaia7G27zx33Go74jSx_5gdgMjP07BOHxIf4AAc2xrh0zk4HXq7I_X8822EpibF3xwxOvNSteJaiHXl28uQN8hwJbtG_zC23u9EstNB7rb9GfBw3sL7sMIzDuVqVc4ACmZYNA-VGSLHqOmHDFkUfpj0PTiD&iv=82&v=1&m=2&r=1652202017723&im=1&b=100&ad=jv=1.0.261:vd=0:na=0:ed=1:tpv=:tp=1:mt=1

Requested by

Host: cdn.js7k.com
URL: https://cdn.js7k.com/rq/iv/inside.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://3130673edb814b6a7c9f55f8c1e26eaf.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:17 GMT
referrer-policy: no-referrer-when-downgrade
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=15552000
p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
x-xss-protection: 1; mode=block
cache-control: no-cache, private
content-type: image/gif
content-length: 43
x-content-type-options: nosniff
accept-charset: utf-8

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame DB3F 0
747 B 30ms
30ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a23-35-228-23.deploy.static.akamaitechnologies.com

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:17 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ed3f4220-6cf1-49fc-b0fc-92b39d0359b2
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0A64 42 B
64 B 76ms
76ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst-s6sxR3j3Wf0xFClIqzP8dwmJTr0194aNIMAybGH0eYw6o5p7J3SEZM6ssvEg0BJs1SJdorw0VGBr54kKJerRfEGAziVzf7YQslfyqs-qrYiAhWNdi8FjqAaL&sig=Cg0ArKJSzPAkuo0YDIdoEAE&cid=CAASF-RoFfQE6vyjoAtXyaqNHg0lHl6vU58H&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220509&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652202015971&rpt=789&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 8B21 7 KB
3 KB 114ms
11ms Document
text/html 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5ba644f0fddbedd145f222319852b63c370c3cb827de34c21e5f0823e6d33057

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Tue, 10 May 2022 17:00:17 GMT
etag: "a067ca1c11975e052149fcb5fac5e2d3"
last-modified: Tue, 26 Apr 2022 01:37:54 GMT
server: AmazonS3
x-amz-id-2: KCkozBJi4ULU4Yc7ZJtC43xdPukcPcyuS1jNvLXws7RtIi4Kkc4u00fUaMH/MTJh7dK3eV1InZA=
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:5eb96107-ea8e-4447-a80a-9b951732aaca
x-amz-meta-codebuild-content-md5: e5441cba1c83e44c16f2d792acc1823c
x-amz-meta-codebuild-content-sha256: 3b14aefb08d603d224cbf56f0ff34e70ebd576659dc2557c0629a8ec6943dc55
x-amz-request-id: N6CWZV0SHJWHSGTC
x-azure-ref: 0Ipp6YgAAAABOVGIHhijqQ4wVls0wHbDYRlJBRURHRTEwMTAAODRlN2RmYTItMTQ0Mi00MzM0LWIzNGYtZTQyZDNmN2RkYWQ5
x-azure-ref-originshield: 07eN5YgAAAABc3vRkFOydRpOZSRFhx1H3QU1TMDRFREdFMTkxMAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-cache: TCP_HIT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 6DCA 23 KB
8 KB 42ms
18ms Document
text/html 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C97%2C55%2C99%2C3012%2C3011%2C3010%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C3014%2C337%2C338%2C339%2C70%2C77%2C38%2C182%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

5de7e8db3a842f1fad50b6b2da1f59993015e6b364b9f3e824ffc0c63a4e0b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8314
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 17:00:18 GMT
expires: Thu, 12 May 2022 17:00:18 GMT
server: Apache
strict-transport-security: max-age=604800
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 77BC 2 KB
814 B 9ms
9ms Document
text/html 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1652202015070

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H2 502 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame 6223 524 B
594 B 100ms
99ms Document
text/html 3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1652202015371&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20222514356%2F
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 311531734a617089da26f33a00b04c59f7f43ec730022c19fb7dbb1c0c86e551

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 524
content-type: text/html
date: Tue, 10 May 2022 17:00:18 GMT
server: awselb/2.0

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame F4E5 0
0 18ms
18ms Document
text/plain 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Tue, 10 May 2022 17:00:18 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Server: nginx
X-Powered-By: raptor
X-Sovrn-Pod: ad_ap2ams1

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 9E06 281 B
554 B 31ms
7ms Document
text/html 104.89.20.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.20.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-20-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 May 2022 17:00:18 GMT
ETag: "40014-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 08AF 52 KB
17 KB 7ms
7ms Document
text/html 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1652202000000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 10 May 2022 17:00:18 GMT
ETag: "623de86a-cf34"
Expires: Wed, 11 May 2022 17:00:20 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding

GET
H2 204 /
onetag-sys.com/usync/ 0
52 B 8ms
7ms Image
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 08AF 0
747 B 38ms
37ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e71ef7b3-02c1-44b5-90aa-19ce5016ec63
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 9E06 32 KB
10 KB 7ms
7ms Script
text/html 104.89.20.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.20.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-20-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1e1effe737d43eef2c03ded33783f5bab1a70585ab0885fb3c82ec827bd6ba46

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:18 GMT
Content-Encoding: gzip
Last-Modified: Thu, 05 May 2022 20:46:54 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=72589
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9496
Expires: Wed, 11 May 2022 13:10:07 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 836D 15 KB
6 KB 60ms
17ms Document
text/html 2.20.157.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.157.2 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-2.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=154398
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 17:00:18 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 12 May 2022 11:53:36 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 20C2 4 KB
1 KB 103ms
28ms Document
text/html 18.200.96.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.96.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-96-173.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a50440f1a89ee6d0397dd031368c87f17cc91f5b05311fc0c272123379b96f4b

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 10 May 2022 17:00:18 GMT
etag: W/"0027ba16a31b2d52cdf78b1fc299e105f"
server: nginx
timing-allow-origin: *

GET
H2 204 ps
pixel.33across.com/ Frame F2BB 0
0 576ms
102ms Document
text/plain 67.202.105.21
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.21 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip21.67-202-105.static.steadfastdns.net
Software: 33XP002 /
Resource Hash

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
server: 33XP002
x-33x-status: 2000208

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 3E6C 2 KB
814 B 8ms
7ms Document
text/html 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
content-type: text/html
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 3BBB 870 B
1 KB 64ms
17ms Document
text/html 185.86.139.93
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.93 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 7d2aca492ac5da0ef28accc75cdad2681c112c215030fb393355244c7b8cf1ea

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 870
content-type: text/html
date: Tue, 10 May 2022 17:00:18 GMT

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame 3255
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
3 KB

17ms
16ms

Document
text/html

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2bbdd9ccfe945c3253c48a77ac6f9d2d9f04dfaf270f627c20ab323145770844

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 1739
Content-Type: text/html
Date: Tue, 10 May 2022 17:00:18 GMT
Dropped-Udsids: 230|39|241|45|31|88|18|196
Expires: Tue, 10 May 2022 17:00:18 GMT
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache
Vary: Is-Traffic-Usersync

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 311
Content-Type: text/html; charset=iso-8859-1
Date: Tue, 10 May 2022 17:00:18 GMT
Expires: Tue, 10 May 2022 17:00:18 GMT
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 8B21 0
239 B 90ms
10ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

GET
H2

200

sync
ads.servenobid.com/ Frame 8B21
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=4450282122236428649

0
344 B

33ms
33ms

Image
image/avif

52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=4450282122236428649
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: cd715d67-0469-4760-a3d9-5efdd6e0eb89
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=4450282122236428649
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 8B21
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=Enj8qRZHnQzqel1ZRmSx0q77

0
350 B

33ms
32ms

Image
image/avif

52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=Enj8qRZHnQzqel1ZRmSx0q77
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Server: nginx
X-Powered-By: raptor
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=Enj8qRZHnQzqel1ZRmSx0q77
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 8B21 0
277 B 20ms
18ms Image
text/plain 72.251.249.13
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.13 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 10 May 2022 17:00:18 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap2ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

200

sync
ads.servenobid.com/ Frame 8B21
Redirect Chain

https://x.yieldlift.com/getuid?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D314%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiMWRhMDIwNzctNTViMi00ZDAwLTlhYmItMjM0NDEzNTUxM2IxIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNS0xMFQxNzowMDoxOC45MDQ1NDJaIn0=

0
432 B

34ms
34ms

Image
image/avif

52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiMWRhMDIwNzctNTViMi00ZDAwLTlhYmItMjM0NDEzNTUxM2IxIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNS0xMFQxNzowMDoxOC45MDQ1NDJaIn0=
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiMWRhMDIwNzctNTViMi00ZDAwLTlhYmItMjM0NDEzNTUxM2IxIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNS0xMFQxNzowMDoxOC45MDQ1NDJaIn0=
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 8B21
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1652202018588
https://ads.servenobid.com/sync?pid=321&uid=OPTOUT

0
336 B

33ms
32ms

Image
image/avif

52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=321&uid=OPTOUT
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: Tengine
etag: OPTOUT
content-type: text/html
location: https://ads.servenobid.com/sync?pid=321&uid=OPTOUT
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 8B21
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5123196422064399096

0
344 B

32ms
32ms

Image
image/avif

52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5123196422064399096
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5123196422064399096
Date: Tue, 10 May 2022 17:00:18 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame 8B21 0
478 B 65ms
14ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 8B21
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=f51e93a8-841e-4739-82f1-0a26ff22293f&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
356 B

38ms
38ms

Image
image/avif

52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=f51e93a8-841e-4739-82f1-0a26ff22293f&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=f51e93a8-841e-4739-82f1-0a26ff22293f&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Tue, 10 May 2022 17:00:18 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 8B21
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-mtWTUNRE2uFx7T.3bO3obkniHSUlfDcX.uoNgSs-~A

0
366 B

32ms
32ms

Image
image/avif

52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-mtWTUNRE2uFx7T.3bO3obkniHSUlfDcX.uoNgSs-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-mtWTUNRE2uFx7T.3bO3obkniHSUlfDcX.uoNgSs-~A
date: Tue, 10 May 2022 17:00:18 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 451 709414.gif
id.rlcdn.com/ Frame 9E06 0
0 111ms
38ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 9E06
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L30EF5WL-27-IS6T&sigv=1&esig=2~cb8889ded82d1aa69d7714a7167dc3f1307ba31c

0
47 B

139ms
20ms

Image
text/plain

2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L30EF5WL-27-IS6T&sigv=1&esig=2~cb8889ded82d1aa69d7714a7167dc3f1307ba31c

Protocol

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L30EF5WL-27-IS6T&sigv=1&esig=2~cb8889ded82d1aa69d7714a7167dc3f1307ba31c
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 9E06
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L30EF5WL-27-IS6T

0
706 B

224ms
197ms

Image
text/plain

2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L30EF5WL-27-IS6T
Protocol: H2
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 83A27867F2694154A5FDDF962E3832E4 Ref B: FRAEDGE1418 Ref C: 2022-05-10T17:00:18Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXeq0Jskcbj8aV4Mzh8Uw==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L30EF5WL-27-IS6T
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 9E06
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWFkODE5M2I5YmY0MTljNGY1MjRhNDhhZjI3MDY4MWY2YzI3MjI0Ng

170 B
232 B

69ms
44ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWFkODE5M2I5YmY0MTljNGY1MjRhNDhhZjI3MDY4MWY2YzI3MjI0Ng

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YWFkODE5M2I5YmY0MTljNGY1MjRhNDhhZjI3MDY4MWY2YzI3MjI0Ng
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 9E06 70 B
265 B 99ms
30ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 9E06
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=2d1W_F3mR4CG_hiXL7qZDg&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=2d1W_F3mR4CG_hiXL7qZDg

43 B
556 B

107ms
106ms

Image
image/gif

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=2d1W_F3mR4CG_hiXL7qZDg

Protocol

HTTP/1.1

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:19 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: KXV7YKT929WWF6FEEAWQ
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=2d1W_F3mR4CG_hiXL7qZDg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 9E06
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/3eifZL3mDGepWl3P2CtaRcn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6746676002484344722

0
239 B

8ms
8ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6746676002484344722
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

Redirect headers

date: Tue, 10 May 2022 17:00:18 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=6746676002484344722
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 9E06
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEMS7L5Fd4-OxTStYE2pmekM&google_cver=1

0
239 B

9ms
9ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEMS7L5Fd4-OxTStYE2pmekM&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEMS7L5Fd4-OxTStYE2pmekM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 3255 170 B
232 B 88ms
46ms Image
image/png 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YnqaIlUcdmQDBe3qw83oIQAABJsAAAAB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame 3255 70 B
264 B 57ms
30ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 3255
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YnqaIlUcdmQDBe3qw83oIQAABJsAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YnqaIlUcdmQDBe3qw83oIQAABJsAAAAB&dcc=t

43 B
645 B

105ms
105ms

Image
image/gif

209.54.176.128
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YnqaIlUcdmQDBe3qw83oIQAABJsAAAAB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

209.54.176.128 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:19 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: HRY3DX3E9ETG1SENM9VK
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: H8N1MPV6KAXCRTF59MM1
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YnqaIlUcdmQDBe3qw83oIQAABJsAAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 3255
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YnqaIlUcdmQDBe3qw83oIQAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENi7ngfsa5h4bRfp8WOJnmA&google_cver=1&gdpr=1

43 B
1000 B

25ms
14ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENi7ngfsa5h4bRfp8WOJnmA&google_cver=1&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 10 May 2022 17:00:18 GMT

Redirect headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENi7ngfsa5h4bRfp8WOJnmA&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

noop
px.owneriq.net/ Frame 3255
Redirect Chain

https://px.owneriq.net/eucm/p/cc?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Fcrum%3Fcm_dsp_id%3D31%26external_user_id%3D(OIQ_UUID)
https://px.owneriq.net/ecc?redir=https%3a%2f%2fdsum-sec.casalemedia.com%2fcrum%3fcm_dsp_id%3d31%26external_user_id%3dQ7054884181305634955&uid=Q7054884181305634955&ref=%2Feucm%2Fp%2Fcc
https://px.owneriq.net/noop?ct=image%2Fgif

0
287 B

12ms
11ms

Image
image/gif

23.75.246.168
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.owneriq.net/noop?ct=image%2Fgif
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.75.246.168 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-75-246-168.deploy.static.akamaitechnologies.com
Software: Apache/2.4.6 (CentOS) / PHP/7.3.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:18 GMT
Server: Apache/2.4.6 (CentOS)
Connection: keep-alive
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
X-Powered-By: PHP/7.3.33
Content-Length: 0
Content-Type: image/gif

Redirect headers

Location: https://px.owneriq.net/noop?ct=image%2Fgif
Date: Tue, 10 May 2022 17:00:18 GMT
Server: AkamaiGHost
Connection: keep-alive
Content-Length: 0

GET
H2 503 ZMAwryCI
sync-tm.everesttech.net/upi/pid/ Frame 3255 0
177 B 55ms
13ms Image
text/plain 151.101.66.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1652202019.675261,VS0,VE0
x-cache: MISS
cache-control: no-cache
x-cache-hits: 0
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-hhn4074-HHN

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 3255
Redirect Chain

https://s.company-target.com/s/ix?cm_dsp_id=18&us_privacy=&gdpr=1&gdpr_consent=
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1668099618&external_user_id=ea22b018-8a00-4a51-85ce-9ec8ac3c8fd7

43 B
1 KB

13ms
13ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1668099618&external_user_id=ea22b018-8a00-4a51-85ce-9ec8ac3c8fd7
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 10 May 2022 17:00:18 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=18&expiration=1668099618&external_user_id=ea22b018-8a00-4a51-85ce-9ec8ac3c8fd7
date: Tue, 10 May 2022 17:00:18 GMT
access-control-allow-origin: *.casalemedia.com
content-length: 157
access-control-allow-methods: GET,OPTIONS
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame 3255
Redirect Chain

https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1
https://gu.dyntrk.com/adx/ie/us.php?dynk=1nd3xx6ch1&gdpr=1&prevuid=&knw=0
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=

43 B
315 B

11ms
10ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 43
Expires: Tue, 10 May 2022 17:00:18 GMT

Redirect headers

date: Tue, 10 May 2022 17:00:18 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H2 200 sync
ads.servenobid.com/ Frame 3255 0
356 B 33ms
32ms Image
image/avif 52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YnqaIlUcdmQDBe3qw83oIQAABJsAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 836D 0
42 B 621ms
160ms Script
text/plain 104.36.113.23
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=53257788&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 104.36.113.23 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 3BBB 0
344 B 32ms
32ms Image
image/avif 52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=1806854812888300646&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3BBB
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=30&p=273&cp=smartortb&cu=1&url=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D79%26partneruserid%3D%40%40CRITEO_USERID%40%4...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=e3889dee-f7b6-4fe5-9497-275881ffe0a3&gdpr=0&gdpr_consent=

43 B
425 B

66ms
17ms

Image
image/gif

185.86.139.115
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=e3889dee-f7b6-4fe5-9497-275881ffe0a3&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.115 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: Kestrel
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=79&partneruserid=e3889dee-f7b6-4fe5-9497-275881ffe0a3&gdpr=0&gdpr_consent=
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1765249
content-length: 0
expires: Tue, 10 May 2022 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3BBB
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=134&partneruserid=OB_OK&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmart_adserver_eb%26google_hm%3DSMART_USER_ID_...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MTgwNjg1NDgxMjg4ODMwMDY0Ng==&gdpr=0&gdpr_consent=

170 B
188 B

110ms
42ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MTgwNjg1NDgxMjg4ODMwMDY0Ng==&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_hm=MTgwNjg1NDgxMjg4ODMwMDY0Ng==&gdpr=0&gdpr_consent=
pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
cache-control: no-cache,no-store
content-length: 0
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3BBB
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D124%26partneruserid%3D%7Bdevice_id%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ba5bde51-e33e-42ca-84be-ce5dffe560d5&gdpr_consent=null&gdpr=0

43 B
426 B

50ms
17ms

Image
image/gif

185.86.139.115
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ba5bde51-e33e-42ca-84be-ce5dffe560d5&gdpr_consent=null&gdpr=0
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.115 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=124&partneruserid=ba5bde51-e33e-42ca-84be-ce5dffe560d5&gdpr_consent=null&gdpr=0
date: Tue, 10 May 2022 17:00:18 GMT
server: _
content-length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 3BBB
Redirect Chain

https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=smartadserver
https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=smartadserver
https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=7be62aac-7766-4f0d-af6e-20ef9c664d78&ssp=smartadserver
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=4694c5d9-480d-4a1b-8146-99d85b44e9b6&gdpr=&gdpr_consent=

43 B
163 B

17ms
16ms

Image
image/gif

185.86.139.115
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=4694c5d9-480d-4a1b-8146-99d85b44e9b6&gdpr=&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.115 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

Location: //rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=4694c5d9-480d-4a1b-8146-99d85b44e9b6&gdpr=&gdpr_consent=
Date: Tue, 10 May 2022 17:00:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 20C2
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=4450282122236428649

35 B
250 B

130ms
30ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=4450282122236428649
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 722.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: f3588fa5-5e4f-4ce6-9862-d88a3b54f019
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://usersync.gumgum.com/usersync?b=apn&i=4450282122236428649
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20C2
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_c87493a6-f71f-4fd0-ae28-96aadec334ab&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_c87493a6-f71f-4fd0-ae28-96aadec334ab&gdpr=0&gdpr_consent=&us_privacy=1---
https://bidswitch-eu.splicky.com/cm?bidswitch_ssp_id=gumgum2&bsw_custom_parameter=4694c5d9-480d-4a1b-8146-99d85b44e9b6
https://x.bidswitch.net/sync?dsp_id=311&user_id=&user_group=2&ssp=gumgum2&expires=10&bsw_param=4694c5d9-480d-4a1b-8146-99d85b44e9b6
https://rtb.gumgum.com/usersync?b=bsw&i=4694c5d9-480d-4a1b-8146-99d85b44e9b6

35 B
208 B

34ms
34ms

Image
image/gif

18.200.96.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=bsw&i=4694c5d9-480d-4a1b-8146-99d85b44e9b6
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.200.96.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-96-173.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: //rtb.gumgum.com/usersync?b=bsw&i=4694c5d9-480d-4a1b-8146-99d85b44e9b6
Date: Tue, 10 May 2022 17:00:18 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

c.gif
c.bing.com/ Frame 20C2
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28uKUZHV-82Jb-72ue2TgQHpNhowhd9KprlosGQj67krwMS9svqOhnVcDtBSf-fFwU%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_c87493a6-f71f-4fd0-ae28-96aadec334ab&obuid=ENC(uKUZHV-82Jb-72ue2TgQHpNhowhd9KprlosGQj67krwMS9svqOhnVcDtBSf-fFwU)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D

42 B
594 B

424ms
33ms

Image
image/gif

2620:1ec:c11::200

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 2620:1ec:c11::200 -, , ASN (),
Reverse DNS
Software: / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:19 GMT
etag: "8120eaf0ff3ad81:0"
last-modified: Fri, 18 Mar 2022 19:39:54 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: ECB64E5531B5470CA7201BEB12A65CD4 Ref B: FRAEDGE1420 Ref C: 2022-05-10T17:00:19Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

Location: https://c.bing.com/c.gif?red3=MSOB_pd&uid=%24D
Date: Tue, 10 May 2022 17:00:19 GMT
X-TraceId: 5043de4ae0c736e371537974d67b936e
Content-Length: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 20C2
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=52d19b78-fa2c-4998-8fb0-4444eaadf586

35 B
250 B

83ms
28ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=52d19b78-fa2c-4998-8fb0-4444eaadf586
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Tue, 10 May 2022 17:00:18 GMT
content-encoding: gzip
server: OXGW/18.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usersync.gumgum.com/usersync?b=opx&i=52d19b78-fa2c-4998-8fb0-4444eaadf586
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20C2
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-788ec49e-b792-4552-6390-7e11f0569e37$ip$185.213.155.162

35 B
208 B

33ms
33ms

Image
image/gif

18.200.96.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-788ec49e-b792-4552-6390-7e11f0569e37$ip$185.213.155.162
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.200.96.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-96-173.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:19 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-788ec49e-b792-4552-6390-7e11f0569e37$ip$185.213.155.162
Date: Tue, 10 May 2022 17:00:19 GMT
Connection: keep-alive
Content-Length: 124
Content-Type: text/html; charset=utf-8

GET
H2 200 gumgum
pr-bh.ybp.yahoo.com/sync/ Frame 20C2 43 B
323 B 186ms
30ms Image
image/gif 2a05:d018:d29:3601:c13b:f765:4942:677a
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3601:c13b:f765:4942:677a Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 20C2
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=abeaa445-d082-11ec-b4ab-73913d16fa5d

35 B
250 B

28ms
28ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=abeaa445-d082-11ec-b4ab-73913d16fa5d
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:19 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=abeaa445-d082-11ec-b4ab-73913d16fa5d
Date: Tue, 10 May 2022 17:00:18 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: abeaa446-d082-11ec-b4ab-73913d16fa5d

GET
H2 204 services
sync.technoratimedia.com/ Frame 20C2 0
293 B 300ms
90ms Image
text/plain 193.122.174.27
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 193.122.174.27 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 913046290
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame 20C2 0
44 B 288ms
91ms Image
text/plain 169.197.150.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
content-length: 0
server: b

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20C2
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_c87493a6-f71f-4fd0-ae28-96aadec334ab&gdpr=0&gdpr_consent=&us_privacy=1---
https://stags.bluekai.com/site/23178?id=ikAeT6WTxoUI6WI3IjuL&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT22LLIFSVINSXKR4G6VKJGZLUSM2JNJ2UYJTVONPXA...
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=ikAeT6WTxoUI6WI3IjuL&us_privacy=1---

35 B
208 B

34ms
34ms

Image
image/gif

18.200.96.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=ikAeT6WTxoUI6WI3IjuL&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.200.96.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-96-173.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:19 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:19 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=ikAeT6WTxoUI6WI3IjuL&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 118
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 20C2
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=779468e1-83cc-431f-9256-f9bc7810a334

35 B
250 B

28ms
28ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=779468e1-83cc-431f-9256-f9bc7810a334
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:18 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=779468e1-83cc-431f-9256-f9bc7810a334
date: Tue, 10 May 2022 17:00:18 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

usersync
rtb.gumgum.com/ Frame 20C2
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://sync.1rx.io/usersync2/floor6?zcc=1&cb=1652202018666
https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT

35 B
208 B

41ms
34ms

Image
image/gif

18.200.96.173
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.200.96.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-96-173.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 10 May 2022 17:00:18 GMT
server: Tengine
etag: OPTOUT
content-type: text/html
location: https://rtb.gumgum.com/usersync?b=rhy&i=OPTOUT
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 20C2
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=VwpZ8hMGDWP7&ev=1&pid=558355

35 B
250 B

28ms
28ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=VwpZ8hMGDWP7&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 May 2022 17:00:19 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://usersync.gumgum.com/usersync?b=pln&i=VwpZ8hMGDWP7&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-599d6d7f7f-gvxfm
expires: -1

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 20C2 0
75 B 18ms
18ms Image
text/plain 185.86.139.93
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.93 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame 20C2 0
357 B 37ms
31ms Image
image/avif 52.30.251.170
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_c87493a6-f71f-4fd0-ae28-96aadec334ab
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.251.170 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-251-170.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 10 May 2022 17:00:18 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame D9FE
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=9ef2627a-9a24-4800-b6f9-505a260bfab3&gdpr=0&gdpr_consent=

35 B
250 B

28ms
28ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=9ef2627a-9a24-4800-b6f9-505a260bfab3&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 10 May 2022 17:00:20 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Tue, 10 May 2022 17:00:19 GMT
Expires: Tue, 10 May 2022 17:00:18 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4390 fb8620d master hkg-pixel-x19 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=9ef2627a-9a24-4800-b6f9-505a260bfab3&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame DB02
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YnqaIgAAVGAvKwAo
https://usersync.gumgum.com/usersync?b=atm&i=YnqaIgAAVGAvKwAo&gdpr=0&gdpr_consent=&_test=YnqaIgAAVGAvKwAo

35 B
250 B

48ms
31ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=YnqaIgAAVGAvKwAo&gdpr=0&gdpr_consent=&_test=YnqaIgAAVGAvKwAo
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 10 May 2022 17:00:18 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Tue, 10 May 2022 17:00:18 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=YnqaIgAAVGAvKwAo&gdpr=0&gdpr_consent=&_test=YnqaIgAAVGAvKwAo
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-hhn4074-HHN
x-timer: S1652202019.775918,VS0,VE0

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame 7804 170 B
502 B 45ms
42ms Document
image/png 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV9jODc0OTNhNi1mNzFmLTRmZDAtYWUyOC05NmFhZGVjMzM0YWI=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Tue, 10 May 2022 17:00:18 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 63C9 15 KB
6 KB 18ms
12ms Document
text/html 2.20.157.2
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.157.2 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-20-157-2.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=154398
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Tue, 10 May 2022 17:00:18 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Thu, 12 May 2022 11:53:36 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame 3C05 70 B
264 B 32ms
27ms Document
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Tue, 10 May 2022 17:00:18 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 69CC
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID
https://cs.emxdgt.com/umcheck?apnxid=4450282122236428649&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID
https://usersync.gumgum.com/usersync?b=emx&uid=4450282122236428649brt47401652202018749060f1

35 B
250 B

49ms
31ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=emx&uid=4450282122236428649brt47401652202018749060f1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Tue, 10 May 2022 17:00:18 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 0
content-type: text/html
date: Tue, 10 May 2022 17:00:18 GMT
location: https://usersync.gumgum.com/usersync?b=emx&uid=4450282122236428649brt47401652202018749060f1

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 3E3C
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=YnqaI8Co8XoAAHNXG5gAAAAA

35 B
208 B

35ms
34ms

Document
image/gif

18.200.96.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=YnqaI8Co8XoAAHNXG5gAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.96.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-96-173.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Tue, 10 May 2022 17:00:19 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Tue, 10 May 2022 17:00:19 GMT
Location: https://rtb.gumgum.com/usersync?b=sus&i=YnqaI8Co8XoAAHNXG5gAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 3
X-SO-Cluster-ID: 16
X-SO-HostName: a-ad40332.dc2p.scaleout.jp
X-SO-IP: 185.213.155.162
X-SO-Key: YnqaI8Co8XoAAHNXG5gAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":16,"gdpr":true,"ipv4":"0.0.0.0","key":"YnqaI8Co8XoAAHNXG5gAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"a-ad40332"}
X-SO-LB-Hostname: m-tgng22.dc4p.scaleout.jp
X-SO-Upstream-ID: a-ad40332

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 5579
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://rtb.gumgum.com/usersync?b=rth&i=EcqmyQF4aGs92pVJZQqQ&pi=gumgum&tc=1

35 B
208 B

43ms
43ms

Document
image/gif

18.200.96.173
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=EcqmyQF4aGs92pVJZQqQ&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.96.173 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-96-173.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Tue, 10 May 2022 17:00:18 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Tue, 10 May 2022 17:00:18 GMT Tue, 10 May 2022 17:00:18 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=EcqmyQF4aGs92pVJZQqQ&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame F8C1
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

7ms
7ms

Document
text/html

104.89.20.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.20.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-20-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 10 May 2022 17:00:18 GMT
ETag: "40014-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 10 May 2022 17:00:18 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame F8C1 32 KB
10 KB 8ms
8ms Script
text/html 104.89.20.125
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.20.125 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-20-125.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1e1effe737d43eef2c03ded33783f5bab1a70585ab0885fb3c82ec827bd6ba46

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Tue, 10 May 2022 17:00:18 GMT
Content-Encoding: gzip
Last-Modified: Thu, 05 May 2022 20:46:54 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=72589
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9496
Expires: Wed, 11 May 2022 13:10:07 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame F8C1 0
239 B 8ms
8ms Image
image/gif 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L30EF5WL-27-IS6T
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 08AF 0
747 B 13ms
13ms Script
text/html 185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS