xn----7sbdfpa2ceibrhv.com Open in urlscan Pro Puny
работно-време.com IDN
91.196.125.197 Public Scan

1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:08 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame C059 41 KB
14 KB 32ms
9ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 13:49:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80512
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 13:49:16 GMT

GET
H2 200 15629130241893552142
s0.2mdn.net/simgad/ Frame C059 45 KB
45 KB 48ms
7ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/15629130241893552142

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4c7c8d83412353edb87b21c16201af094f14df7552075f649915048b3caf053

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Mon, 23 Dec 2024 23:04:06 GMT
date: Sun, 24 Dec 2023 23:04:06 GMT
x-content-type-options: nosniff
age: 220022
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45919
x-xss-protection: 0
last-modified: Mon, 16 May 2022 08:57:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame C059 3 KB
1 KB 28ms
9ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52878
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame C059 20 KB
9 KB 27ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame C059 203 KB
65 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:08 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 73FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHhyzLWXektbAeyBThHCuHM&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHhyzLWXektbAeyBThHCuHM&google_cver=1&C=1

43 B
774 B

28ms
28ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHhyzLWXektbAeyBThHCuHM&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COSyFxCEqpkBGOz_3MoBMAE&v=APEucNVlsVI_ZNfhsmi7QBU861PTWt1lnDrGBG-kHJ9DN3wHPK2wITSM4RWpcOI4idS9eL95hD5FboSuQlEbbAhW5_5et26cofJafFD5luoGoBfJvlSn7NUK80eeXiKzld6S1eQzTEolAmKHpGDUh2DvJf4OLCSOEa6OWXaayDUxbiHz_OtOfoc
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AX%2B3Vz3ZfPs5PB%2FMyhUbYK%2FjvYQSZqwZ3ElfsddAD8fJVp97fg49gHR4qkH9UzV%2FYZc9dWPB5npiiQVBKlJ7qKJhWXFEweuwSnN%2BoUp90onYXJrUtKKQH%2BN4eUq8oHEf37k2SY9wPP0H6A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83c176e0694b19b1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b2%2BLGRFJ6BGZ5pkm%2FBOy49v3Dxg7SYBRtMz1iPP5l%2F%2FP9F4lkE5mNlAqhkmMyvSLIwECW0WWZyfge5abeJd5IC%2FjQhyupzZfgGy04Z0pgbjdzJH8DlR8ZK3gp6xm9qyVZOTufAuJteix3w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEHhyzLWXektbAeyBThHCuHM&google_cver=1&C=1
cache-control: no-cache
cf-ray: 83c176e03dc86916-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 73FE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZYwUXH2KuSNyEfTDSf2RqAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1

43 B
735 B

24ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COSyFxCEqpkBGOz_3MoBMAE&v=APEucNVlsVI_ZNfhsmi7QBU861PTWt1lnDrGBG-kHJ9DN3wHPK2wITSM4RWpcOI4idS9eL95hD5FboSuQlEbbAhW5_5et26cofJafFD5luoGoBfJvlSn7NUK80eeXiKzld6S1eQzTEolAmKHpGDUh2DvJf4OLCSOEa6OWXaayDUxbiHz_OtOfoc
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BZ4e%2Bju6ex3vuX5EgcDDjASoQrGOP0IjKqrDlMmmoxZCwKdtNqumdzPc2JkWFtfx8VnXJxYzUbnrMxbx9g8LjJ2BVtKJT%2FAo8ZjuFUqsTzIWq3Pgfa3%2BUyDvIXLwws5UnCWXXcMCLy2BGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83c176e0a99419b1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 73FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKUt3uakjJgQZET8vlV7SvA&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEKUt3uakjJgQZET8vlV7SvA%26google_cver%3D1

43 B
887 B

35ms
34ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEKUt3uakjJgQZET8vlV7SvA%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COSyFxCEqpkBGOz_3MoBMAE&v=APEucNVlsVI_ZNfhsmi7QBU861PTWt1lnDrGBG-kHJ9DN3wHPK2wITSM4RWpcOI4idS9eL95hD5FboSuQlEbbAhW5_5et26cofJafFD5luoGoBfJvlSn7NUK80eeXiKzld6S1eQzTEolAmKHpGDUh2DvJf4OLCSOEa6OWXaayDUxbiHz_OtOfoc

Protocol

Server

37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
an-x-request-uuid: 5a5fa44b-3888-423b-972b-4cae3134bb47
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 81.95.5.37; 81.95.5.37; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
an-x-request-uuid: 4e5c2a02-47fd-442a-8d9c-1733c68ff840
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEKUt3uakjJgQZET8vlV7SvA%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.37; 81.95.5.37; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 73FE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQzOTc5OTgyMTU2MzA2MTU0Ng%3D%3D

170 B
243 B

18ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQzOTc5OTgyMTU2MzA2MTU0Ng%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
an-x-request-uuid: a89dc8ef-83c2-49db-8b26-e9039e4b882e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzQzOTc5OTgyMTU2MzA2MTU0Ng%3D%3D
x-proxy-origin: 81.95.5.37; 81.95.5.37; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame C059 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2a0acb6ed9ed768ec20e4dc0520a037729a85472d33526db33955c98d057caa4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9A7F 38 KB
13 KB 8ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78629
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 14:20:39 GMT
expires: Wed, 25 Dec 2024 14:20:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame C059 0
0 46ms
45ms Fetch
image/gif 142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuAB2mkTJaUPcjpARQCV6Ti6i64QOyXG-QxI2Cjic-mqinU-rA-tdTvVDhwIV5hFWz6ZmejvlLl0iqpWsvgGjl33K714EoItdL9JMqqrg7Zd6i9oe9ipBVmjJnsHLyXGDSZpXOH12TMTuHhLwGsn1fqB8LEOv5sWVqdy9AFi8VZyezcY3Vsr555Zn2Ji6lhjOsNzhnGS2nU9DzSQIYiGqmEu4Ita0WwKBWGzT-d754j9ihccAnxc8kMVm-D8WyBI8utg-G-LiPrh4V0u6bbFWEC1rsmQS5Po-KpBeoTduTmk5-mu3-OXSuIIpEWU6XZ6OIGeORQhI8UokWz0qWb0fkiBk0QBbL4aOMW-0vsNOj0Dv5aUAOaMCO-dN5andmtq8-5XwrB8NvK7_kxhBEaLp55ElvFTp5q22Hh_vucSNqmakL2HaOGhIZtcjztJH7sbRr5S0LbbHDTyGhLYPu58h1miwpvub67ibtvqM_XOhSGe0NRg7TMXD6lan5nMmLZsChOJVFCnSkRWw9l363FXJV0fNOfdHCBDQ_-sr2hNAPPLIXQj1LNxEtZOp3CGyUYevLUjZHLrsgmj9jRrzoB0jCZCJwVYWChQnw_AqlBhnwMUt8YOtOyfrUYHVzDNSdc7rDZAdAtX7e1wpVV0m71B71l7kT2_nELVZDZVakZcbvXgUv55lUX2l3J7WZCVN1k6zgkAViHY4EFopCsWEag7f1Xc7tULNbYv7ME3FfDx_vTr5uXiD665cX6CygqF0TWziseTXAlEJ7XcnRwSB72vCfyY8JAt9GcfGcvtercGqgIa9g-Im-EqHN-gtYxiyPSDu5xzPOx0MVywlA7-zpzif27O2k9p62oAjaOkw27E2jcq-Soe6KjuGDGg9YNODgQV0im8gCYbzto8isFFjc40kY_oywfqoT5YRuhDYupk3YSOINO5OYsJW9VYI-Zg89Vl5fr6oGiQy1TzhQiUdUzjfi_YTaFg0vzmtM0uhQSPT-k0AcbHbubHeetTqLRWZ6k4zGuS8OiJsrCx8t8WBX2ZcybmeqwujhEAyqCNXJKBgKdkiVEN5ra8mtrqRnzS_LsTzi35JTSV3XsOxN3Y2K9nhQQvOlPOM5iigmcCQmcboLBKizhsFjOu1vb8B8l0-BB3Sd2Y1wf5lwfrWvP2W_4D6mcSSZvioGq2MFG6q5EowsvCMoKdUwojLqy2jyiyb-yyIIW7kisOd7XTNtOKIkWNXF38eu1T1IZnwr2avqF0iFoxZ_kO54D-rY9GN7g5u2_3V-2CvhvTb3v7P-nDcnhp4OGh0XVGZDzKUlHMxqxKPJAVT5x9zmNBUC7am2Cr1SBZYCAdHiA1IqN--oWLJPp&sai=AMfl-YQvBXEnxE_AjSB-ShkIfVJ8Gh8AaRMAjTKuZgcc2JCt8_RtRHbEuNdKk-BZ7YHCu-PboSpOxfHeGbcbrMLN698r-wYb2Moj6JsN25zYdrdWCb1dzdsUiABG3ye9cpxkIYw7yW61ELObKjajuOGSlf0xYlRWBmHl9k1l7azVAnSyFzcr9GY5MXcFoJ2R-RKd_Ut6eLNiTfPwuBzY4jXO05g-r6f9ZAsl6PAq6q9WMaigud-TgR0xVYHSNdeSmqaj8KxSqm0GfqrW0nBgozPcNQhaIpas5JvriIb9yrKLfdxl2cnTVYRVEpecxPvQiy-bVIrRffcvNJKdga4WIr3_CCmfUzsXT6DUUtsUCO3H5rW0rUD5l9MnsAh9oqn2Hk3mRD6sf8iozTzFSZB8EK2UQqmpOvQNZbAeBw5wut1a3tAbEWfBS8cdK3Wemd_rN2BoqFLR0VxDGqimUymw7Nsvfu_cr9U39EfiIgpmSRzuJfQ8NFXuDIzifDFB_aypYcHl1FW3tA&sig=Cg0ArKJSzNi0okO56aHrEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly91bml2ZXJzYWwtcm9ib3RzLmNvbQ&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=102&vt=11&dtpt=101&dett=2&cstd=0&cisv=r20231207.53224&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 9A7F 39 KB
15 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 10:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179746
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Dec 2024 10:15:22 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9A7F 0
20 B 45ms
44ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B0zQXWxSMZbKFGOnX1fAPsNmBgA4AAAAAOAHgBAI&bg=!eHulezTNAAY3kmNgF5I7ADQBe5WfONgepcq-VfVsPmde_kmJ2kgN5mPIriYAFEaymKXc3EBxOGUs8IaDIJEI75xFsIwUAgAAAEJSAAAABGgBB5kDLCxINiwaRYXucOfGjtiMtoTqHZg4JUuLr04TeLvdlevNklvXUtFLsRHnHXoaBIfUWJpZnu-gfbY-UtysDtZfgj4rZPSgTbnYXDpVMFz4bmDrJZicQVE2u9KseLIREzK6OiJieuw94ajqCp13LJN-5jVNSPmsjmGOi_XyV-lp5HF1bsk5wCrnTNZlKkHuU1okwLqzV7EqxaVxM7fiyYBPnRdWHwDVIZBGBiJt3--Y4dRFzIUaAFjhYvBBnGS6haADk8j7cXeWwPflyq2TIXkpL5wC98oFI9SCX6Me9_jjcVKyeopjrgOx8yw6rnwCLEwUcEDlUANsTZybukzp1q_9FZc1hl91S7DuvTil0uyNOAynxt5mS5Qz2Rx1wqQmrkCXkkt8RfbXp3IMZSvUgWqhU2iRF87Bx_eWytuvb5SfFAwwVZGcvqKZYTUpbNNpQzOpk33cpIFoSF4wm5hJbdd_FGGiq2xzBKDNTflP4F14gzWea90FOtaCHx-Fc4UsZiDvgqA-bSYCXfih8GG6qKAhru3M6pxNjzkIhs7GCW4ID8Nyv146QS-VuYnfpRCvd5wDODkacMjRpPvKMZqa5so5RQBOTVm6YUOzPbRcY8gGqpAzKAckhbK9KBAXNbaQpmeZGcgEC9P47afq_t0tEhE9qjyNrp7Xy_ZWrQwj1kIGDAcqnWU_SOCzf4YZw2rHWNAazfxKlhC9Du1BYGjkN0ySBaD5UlMxQ9ITaZodp7CEK2bkVA9uqyNH0IHpG-S6qsuOiX5ODEf8O_3W-bl5YmzNZKJIVk-P8q8OkutPMnjAXS3_859zF7JsOjL0pkB89_QApuKaNy9DCFK7xVgYL_Oontt4v0Q6qZuaojuDOvZi0Piy_MpwH9tf9PE3QSUANEh_35ucdj-3hqu_1Cyo9z2kVWPG3wtAS3qpcHVyKyIMGN-jZalbiPMT4KII40T9g23ZYb-ZIczGEdg_MUdtKj9Nb0JkmNtJ625NbYKH41_o12Gj3ZlAy72YGwZIGxrPbug8aSWGuJU8OIz9LSI5TO5s4Bz2lXkHpCHjic4sSU4A1vpNyGiIJzVw9U3ghSB4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame D9B3 14 KB
2 KB 39ms
15ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&slotname=1821193457&adk=3954062228&adf=407486717&pi=t.ma~as.1821193457&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&format=1200x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679067180&bpp=3&bdt=192&idt=170&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&correlator=797003850337&frm=20&pv=2&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=16&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CEe%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=184

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 27 Dec 2023 12:11:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 27 Dec 2023 10:28:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 27 Dec 2023 12:11:08 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D9B3 2 KB
822 B 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame D9B3 23 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52878
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D9B3 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52878
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame D9B3 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame D9B3 203 KB
64 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:08 GMT

GET
H2 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame D9B3 37 KB
16 KB 28ms
7ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 09:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 26 Mar 2024 09:13:33 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/8795415732506438307/ Frame D9B3 31 KB
31 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8795415732506438307/14763004658117789537?w=600&h=314&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28c16c4ad9ed85ca50c424e36f791896e03002f879524086e6e1d25b5492330d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Tue, 24 Dec 2024 20:04:41 GMT
date: Mon, 25 Dec 2023 20:04:41 GMT
x-content-type-options: nosniff
age: 144387
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32028
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 22:27:17 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
DATA 200
OK truncated
/ Frame D9B3 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44eefef34507164f4234b958d8f6906488a2521071379498041568bae9499b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame D9B3 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame D9B3 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a551c48b5aacff4714ac7d8272f2d076efddc0d9110592568173b4fcce472fdf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame D9B3 33 KB
34 KB 194ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 20 Dec 2023 21:01:51 GMT
x-content-type-options: nosniff
age: 572957
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Dec 2024 21:01:51 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame D9B3
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CyOepWxSMZZriF9631fAP56un-AyZ3-zZb_Do5o6lDOujoYWYDhABIJKygg5glaqzgsAHoAGumIqiAsgBCakC7KsyHTOHsj6oAwHIA8sEqgSeAk_QG4wctPr_mIrCXWr1L_jhUFiV2LpQEHF...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2215383846737522053607%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%2...

0
0

63ms
44ms

Fetch
text/css

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2215383846737522053607%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%2222%22:[%22true%22],%224%22:[%2212-27%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%229594260135603470449%22}&andc=true

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"15383846737522053607","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"22":["true"],"4":["12-27"],"6":["true"]},"priority":"500","source_event_id":"9594260135603470449"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 27 Dec 2023 12:11:08 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"15383846737522053607","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"22":["true"],"4":["12-27"],"6":["true"]},"priority":"500","source_event_id":"9594260135603470449"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 1886 50 KB
19 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80f4d9c7c420e58b6a1d8013b9512aef088d5e019824b98db55e90fa74480346

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 09:01:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 97756
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19632
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Dec 2024 09:01:52 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 166ms
42ms Preflight
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 27 Dec 2023 12:11:08 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6BAC 624 B
245 B 49ms
48ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_kmq0EEPyP_K0EGKOu0_sBMAE&v=APEucNXfV7sKIIUEk7FBCaBxA3iUdO9unmx8uqMy6crFb5mrPN5sFxh-m340hWImk0f6ecorFM9iH_9vnAVmdX-XZWvI0_IFd5ufn6JUF-2ZLX2dTdLXNfxrPUjUFb1lC-Yn78LWfg5nThgPJp6J15DmaS90pKH90Km-glDlnZXuKPvSvDum5KA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&slotname=6883943539&adk=4282727254&adf=736642607&pi=t.ma~as.6883943539&w=336&lmt=1657202602&format=336x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679067185&bpp=1&bdt=197&idt=190&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280%2C728x90&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=694&ady=828&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=193

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&slotname=6883943539&adk=4282727254&adf=736642607&pi=t.ma~as.6883943539&w=336&lmt=1657202602&format=336x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679067185&bpp=1&bdt=197&idt=190&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280%2C728x90&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=694&ady=828&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=193
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:08 GMT
expires: Wed, 27 Dec 2023 12:11:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame E7E6 89 KB
31 KB 125ms
125ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:08 GMT

GET
H2 200 trace.js Show response
t.mindtake.com/tag/cid/5531K7/ Frame E7E6 1 B
382 B 141ms
31ms Script
text/html 54.171.74.88
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.mindtake.com/tag/cid/5531K7/trace.js?gdpr=&gdpr_consent=&DMP=10092&BannerFormat=300x250&BannerSujetName=banner_300x250_family-holiday_at-de-ch_pauli-immer-da_kakao&Misc1=image-familie&Misc2=impressions&CAttrib1=https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html&uid=1703679067402031
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&slotname=6883943539&adk=4282727254&adf=736642607&pi=t.ma~as.6883943539&w=336&lmt=1657202602&format=336x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679067185&bpp=1&bdt=197&idt=190&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280%2C728x90&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=694&ady=828&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=193
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.171.74.88 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-171-74-88.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
vary: Accept-Encoding
access-control-allow-methods: POST, GET, PUT, DELETE, OPTIONS
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
content-type: text/html
access-control-max-age: 0
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Access-Control-Allow-Origin, X-HTTP-Method-Override, Content-Type, Authorization, Accept

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame E7E6 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52878
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame E7E6 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E7E6 203 KB
64 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:08 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame E7E6 42 B
63 B 44ms
43ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DIyuVJ6M32IjI6pEMSrgD2HR8gZoIZ_UnnE-xT9bgAsqIA9QSKmfDfb1ubnMyxjY_mU3BO5lVcMK6h2QvzXdDxWecN5agbdGuJG3AP7RGvuZU64_I

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6BAC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1

43 B
734 B

27ms
26ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_kmq0EEPyP_K0EGKOu0_sBMAE&v=APEucNXfV7sKIIUEk7FBCaBxA3iUdO9unmx8uqMy6crFb5mrPN5sFxh-m340hWImk0f6ecorFM9iH_9vnAVmdX-XZWvI0_IFd5ufn6JUF-2ZLX2dTdLXNfxrPUjUFb1lC-Yn78LWfg5nThgPJp6J15DmaS90pKH90Km-glDlnZXuKPvSvDum5KA
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RTWQR1CE%2BE1P2%2F8ytt8ghyEygXcZk1XZQO93txEKKiX%2BlGS35kmG%2FTz9hrt462wjISEJCLzuDg1LiGCgvW3hACu2qRlD4ao5t9x%2BzR3zzbCgPcOi1370aNNQ3XysPuSybkmq8tqxhdkrhw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83c176e4cf6c19b1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6BAC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZYwUXDiHcw0gMdHTZohcVgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1

43 B
733 B

22ms
22ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_kmq0EEPyP_K0EGKOu0_sBMAE&v=APEucNXfV7sKIIUEk7FBCaBxA3iUdO9unmx8uqMy6crFb5mrPN5sFxh-m340hWImk0f6ecorFM9iH_9vnAVmdX-XZWvI0_IFd5ufn6JUF-2ZLX2dTdLXNfxrPUjUFb1lC-Yn78LWfg5nThgPJp6J15DmaS90pKH90Km-glDlnZXuKPvSvDum5KA
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iUbLcJpynaC%2FTQQ7zADZbpoURP0KRpkKRyi%2BTGg%2Fw0%2BBa537dYw0a1IseucCyG69UkBMCc1KIyrVt6sJF38pwLCBYqOlExvNqAl8Qc9KmCog6TRiprVpGyzUce9ixVXEMsC8yCRqO4LNxQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 83c176e4ffa519b1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJEnZqGyEpS6mQe8bRLuc1k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 6BAC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMBnkc3MKhzqCW7OfzVCObc&google_cver=1

43 B
839 B

9ms
9ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMBnkc3MKhzqCW7OfzVCObc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI_kmq0EEPyP_K0EGKOu0_sBMAE&v=APEucNXfV7sKIIUEk7FBCaBxA3iUdO9unmx8uqMy6crFb5mrPN5sFxh-m340hWImk0f6ecorFM9iH_9vnAVmdX-XZWvI0_IFd5ufn6JUF-2ZLX2dTdLXNfxrPUjUFb1lC-Yn78LWfg5nThgPJp6J15DmaS90pKH90Km-glDlnZXuKPvSvDum5KA

Protocol

Server

37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
an-x-request-uuid: cb5066a6-1be2-4f96-862a-b07946d52105
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 81.95.5.37; 81.95.5.37; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMBnkc3MKhzqCW7OfzVCObc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6BAC
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM0NzI5Mjc5OTAwMDAxODkyNg%3D%3D

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM0NzI5Mjc5OTAwMDAxODkyNg%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
an-x-request-uuid: de910725-80e9-4430-b626-741bcc2e1fdc
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTM0NzI5Mjc5OTAwMDAxODkyNg%3D%3D
x-proxy-origin: 81.95.5.37; 81.95.5.37; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/ 160 KB
55 KB 74ms
73ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202312070101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

845f85e1514e9daf9bbdce8848cfb2291516fd1c08b33b5442866771fdcae064

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xn----7sbdfpa2ceibrhv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56013
x-xss-protection: 0
server: cafe
etag: 12003103348929325532
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:08 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DCDE 40 KB
17 KB 577ms
576ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&adk=3809598800&adf=1839787983&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1958&idt=-M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0&nras=2&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3353&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=1&fsb=1&dtd=4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a38b331f3a13dfab7666821c1d9e11dc433f43767059385924fd1f4c837793c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 17079
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:09 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5B4E 30 KB
13 KB 505ms
504ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d52741db32f1a624729867ed7d60dbe605919630ec5925ef3dfc362590736a5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 13137
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:09 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_auto_rs&sts=pflna&evt=place&vh=1200&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&hl=bg&pvc=3570524922569749

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xn----7sbdfpa2ceibrhv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E7E6 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3046132941148&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E7E6 0
20 B 42ms
42ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3046132941148&version=m202309260101&ct=119&x=1&cor=14742596278492654000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame E7E6 92 KB
38 KB 70ms
70ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CaDqqNksk2d8kzWzE7uLxoJM339YPpVVw8eygbiTmt6CZWfs4deGJB7IAJ_Taj-mOZRgsayO4HAKWGSkWYgoKkolOFcJFyouF4ompowvoeB36QHdTJEGie-7pID32i3GY6tqruxbtgopdQoGPRk2C1ceUgclKy1xzP9OM1mLnwherrE_LTHuQlQkujgMIRUsNW4zSP&cry=1&dbm_d=AKAmf-DbjRGbpSMeoB8DMf7VvLWBI0r7ELhdovYw6NKL2S_9z4NgUTsJjvNeDsyORq6sdpvTyzCIZU5u-pRc5FzHh7t4acCv4e9641u7VbDnHXZMTRwOnx7oa7XjSwTCd12F8PzpShk9WZytLYkJJO5nLuZCOzDYUdu5_HtFekhk_972MMHuEo80c5cz4OxKi-vYNOI3raqR4y76vi-PIr3pYBBvvbjLgn_DXqgwLgXGBgBDsYcw5OzbJ7t4NjuGbKdlL3pRbu2IkQlLnTDMftHI1ED10YKaYB7Wclvnoqjh_w9ZAHMCHmNRzulUDuTgvktiwOzDqqxuno9gpJh1GiOKQ1_C0KlfQJ82r-EngmjoJF-uBdpJQlnByxgn7xZhn4Xs-Io90IIrSIaZJA8pzCkwBmD3EV6L5xG3JxmPcEb-k8KFsH7rtWKvCnHHdgJgEl2Ukm1wl0megzgu2OFbMoYMIknYhjG872DC9YHHfAseiXUtNLnOphdmjMHwPssWaFqzt6x9Hz2EETBU5GOw-YPaR6Ce3kvR5Sx-k5-LfiMp4x0CAWmbDnJgy9GVoyrZzman2k5taVzw6GgVVqQXr1IpTn22ch0EV2ifI3hcsxjE3rGLZnfSkSvwiUCZqTv88bBDzzxaioem0M6xj-e2J6rCJypgSFHnEHAu1TOkah_Lk7BmcuOE07YTlBisRO1SCQH9VTvdUfKF-iVZZuAUPfSsTISAg6Gq76g1rMGPbHV13Sfu4Zb9c5CHfEKMMAfpZ9Non2xSFVIszEkIjgYNLVY6VWZEqf5cEtnwlr7TvcKymCoqj8CjAphTMIQaiEb54w3ZtOcf1Y1ECl4dXZHIjTts5v0Kw1x_vh3iu1iJGl4kSct2MS98cmgaxp5XHipANuTD5BRlpkA-CsKw7M0nGJqhQciaogzIbhAcKpwFmdSTX_6rsouviv1lrIrw9g0T_bRExHMws-kCfGvTBaLHrKd_lqfLJSPM9IQ1jiqgoU5iR9zRp7uN-C-c03y6WEzaMljht9QKu8cSXZrQT9Ze6n4rSox0pxYOWS4F76tQ2YX1cVuL_JxAiBP0pASzVy2LuM9vsawr5FdvTCa5kpG36EBD6ANpW1cW2gVX-fUYhcZaUbGAgd_TTiX9ZL6O6CpFG7ZxjITJh0k9O1SHsl7VR0fCJYGEGgLe46bDY8eodkwZHbQdiq891Icb0LJ0HOu8PLp9oCrtSiKEm9h55V-AHD0vlovl3yL4T9KN8MqR474UaFa6USveK6COQCKrTVtMSSiIn3IP3k5irlmy0884yP6z_78rcxQtpfHWTqhD2ZTATCdowbnXnXDSMQIj1TiGt_p3cP01ggu1qSd-CECs94knVeBeYYxWTpyvvfUJJaTgvC-CSdXyAMHXXs9N1SmoxjYLE5fsTumOymKFxWDci2oefLhRpHYHinsYMlC_dmIDZlaUfDs-3-jCwYMydND2604HG7dc764JlN_IZtChHN3_o2M7MTam3gPIOiL9Bc3DUnjyAhUnamKwHM5VTM-F5x3Fl5TrG9sPkj2nlAsbWiz65KIrYNY-TN1taqhsJSQrj9NpKY11fU1UocSB2r5O6DLqxluVPnZsBsowlKcmmwuosoBwNNZfSsxW1Wg2YRX-14RHLTSWhFaHYLLITjnVpIQ8K_ZYGRzZ7pMlKvKYXmlT8TWOdfRsaWR95B9fb0_MLD9CJVE-1KQ92cgfmjvfoQId2X9YhSpknxzlRfjpDWnXn48QQfON6728-UoNmu-jEnloKBlfmXpKjoMbted84MAa3GEcNfFcd5P-1mLrwaRRqBoVsMrSmHIL17v2EQb2rX6zw4lCJbLhaWqsHNVxHfWHkiz-HDbBTGr93kUuBNuR26IV58jj_nYZsVGrUQKtq4ZhNdGoRDoieXN1N1dxMYU1w3HoVx6Lxt0vXreC12Rk7MCdU4MhMGz-vvMd4Wso8mJFU8QGlsyzN-ZQTR2u4XGQi2QcILeFUr56MfIqyR9ZGvIzlp2phhfknWGbpyuwfqETEkHSiGvqER8lifkIkl6GdYJJm9dPHURE4kHPm1HaWAubrQ2IG3rUfP7YAWyAQHC1zdXJkIZ3HtXdP_hoaAzQk69Nt2aqU5A9tpQfpb01hm6OzS9EMIx9v7g14m268s9znkJ5kJIYwmSqWHjO2_6PgFqXLxEcG2wbIKF-QTX3JiaCgsYiJzQZi5lCEZL0IgUbsjb6xGRX-sh9LVM9iJc_hyzRaIU2Uu7fadqPuh-Iorua47fJZedh6n6MWLVAiczBfV-td1RVGoSRr7wp_s6SvTHKZ548buQThB11nI1W12XFadDcZ1r9WHtnsq4YZ2_lsIs_qeQXL1_KnImu-ekLRsPFCrKG68q6rfCakyIXPvXnbIgoSvs8Qlxbc0QRj_k_xYpbEwBlT94KohZNpqaQV2KjVrSmJ9Jia8-obZaJeTjEAz_VlJTRIhkdqpujEYyvL7-8C3bMJitDGxFnk9Tmpcx4LmPj8JvOoR1rc5MVFfdCf3FEe43myUjqQsg2tIo8n9YU2loJ6v3x7TdInIrxYLUJAwssDKGXY9irfU44TqCRV6QDbm-SJpKo6UF2JeGh90_cuAB_1GVLzu6ZZUXI1Fg6rivjsfKtiJQHLYyFKuhAseRUlcgqHYZu8iQlRKBE7pznpF1tKnaGKVjhU8pMdyTE-qqHXZczDyBbwWfNolNts-tbs-7tBQOYlC52qIXD5j4afuw8S4-wBhSzJqzjp_3fh24N9GWpQtT6CJVZpriMXFzeGrV7V9tHIpYU7Ar4ww22Czp40wE0llnDfAVTwI7v4r_fyS9K1iVrAb6-6EjyNPtleAU11sgYzve5zGaIGCM2EEwPhVbX7Cnfqt04skNb9-hm9ke3I7B2bYUf3wAQVmg9uDtVhZ2MWozGhUYE8EAYY5nwSs1e0jpqzMQrVxtZ4jnnpMQ71KIFiCRLek_yi6POWYpA4cybDe4gwT8XH4UJevhSJxjb1SRzLqgk06lBwoz8QYjtBzmjZI0OEiyJ1e0ui_k0-3NRjvYEbCfWWckVadgeeVopBIqHIrfvHxYb9h1weCHeEHTIK7_YRGan53XT9D6lNhVRWIb62_oP_Ta92B7gIRVQwP7W2BUViDRcLm4hfGWirW5Vr7EnHFGWDczGeuRXQARgBJHoWLpURH8Db3qT1Kr1Tq3WKt23fXQJ4ZpVh11t1iqTXWaJHq8O0GLidyRf34AbF5R6XymJG2_55sXHJtdKa49rB_yZQeZNZrSkNuDWZ8MVmXXHqGs6-1VBYkiMus1UjGbMAR0ML-BuT6u011h5Sy6pzFkEDfvJZPSRshB0YbxKEOIeaP8b0FCyag-sGetYAw3VHsvRUNaBccDWws71KxXBZGiE2ogOHJ5SANOVRMOuqLIBvfsYepiy8ZJbV11CsfYJblc4wR3wZXK0mVTIvHGZRnVajUdunedd4c5wjRwkh1dDA3sLzrzo7CUw-ZfHFBwhg4o9CNc-s4MUpdDYJq3fDaWZ1kHgbF5hgSth5Bb0Fa_HV0ZB1igvD79KXP_U4JGlVDv_eUmjjtkRi0oS80C0nAhLVtyX4IEZhv58Lo4_m1ZH07aDSlF0CTPKO9ixgzrKUUsZUlI1SOuJiVw7tY9FrxtBrM2E0tRbTBgDQoe09L6GT33Y-kW-R4jKe_Bdad4VZWXu0d1dnckKuuyMprMTS8mNBpiO9joPbz2N6fG5hzQeVqR1FQub_Rfkg9NUQiE23s9VVPtk0mW3DW6dKLoDc7IftmXsuBHExbEO1h7F_P_W97CC-fL0b_RL23I0nLaP35vVavyOTilY3EHL8ZeJE-zv2mtwRJ0c3mE2sqpZQ6kxhaKyz1aij8d5Zh3ocCWROg_pXqnJzd6AjNKeR3ZK4Nfdu6HnPDlByKTLC-3D6_-BpD3GkX2alIngLxJWde2z9ESwEPdUvttRbqUuNmnXYn8Mm3nvuIuJWGgxwYFHed9DYb6X6dZ6r0rWtTbifF5CCkrcTlXx3vPFLU-OtJVXIfsXzjPCjgcaUiBQcuHSG1jfum8-gQamQ6C5KQaMp6u3354q7_61UTIC1Qcc7i4TI7GIv677lo2Ch_tKX2sFmTtLpeN_Ozb3VoEGlV3bnrPn2rTlY06Vmbpj21XDm3Q8LbNlbPiUcjn-KMRjdW9a-ngO7Pj8cXTsKVTYyyAuT0tf2Q-IzP5Rv2rm18gU-_88lcUzSZOMjTPAJrLm1dMn-jZIODVHNWVesZtpFATKbELoTbg2_oX7oeJaqjRUSfMyRxfj8lbDiJDJFtqg94fBlzAbS57zbyjYl5H5giS8ASEujY37qp6zqlWcfPruNcDcE3yPxgd8xqlyzwU74WpZXdoKUWGNowORT2iSqpCN5E21ftLSyzv7WDC56NXjsgxpYg316QRMjwp_&cid=CAQSTgAvHhf_sGYJblCbIzB8KY1iaGFR_JQ37WJH7UmvgcNoLsBO9YlY4XLbhPkAPmZBlSnTAdywPHi8mCpqSPwIbm54olAqBuaTGAmHduH6VhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2F&ds=l&xdt=1&iif=1&cor=14742596278492654000&adk=497053792&idt=130&cac=0&dtd=16

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80518edd77274d5c9c42d6aa8c8ac816277aecbf25c84f33c1708d09d1c51d7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&slotname=6883943539&adk=4282727254&adf=736642607&pi=t.ma~as.6883943539&w=336&lmt=1657202602&format=336x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679067185&bpp=1&bdt=197&idt=190&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&prev_fmts=1200x280%2C728x90&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=694&ady=828&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=193
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38992
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 1502 9 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 28442
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 04:17:07 GMT
etag: 5585625838579639069
expires: Wed, 10 Jan 2024 04:17:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 8B71 9 KB
4 KB 8ms
7ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 28442
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 04:17:07 GMT
etag: 5585625838579639069
expires: Wed, 10 Jan 2024 04:17:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 4E60 9 KB
4 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 28442
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 04:17:07 GMT
etag: 5585625838579639069
expires: Wed, 10 Jan 2024 04:17:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/ Frame 6883 9 KB
4 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 28442
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 04:17:07 GMT
etag: 5585625838579639069
expires: Wed, 10 Jan 2024 04:17:07 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 1502 4 KB
767 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 27 Dec 2023 12:00:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1502 205 B
519 B 9ms
8ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 14:24:49 GMT
x-content-type-options: nosniff
age: 78380
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 25 Dec 2024 14:24:49 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1502 604 B
695 B 9ms
9ms Image
image/png 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 18:24:42 GMT
x-content-type-options: nosniff
age: 63987
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 25 Dec 2024 18:24:42 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 1502 16 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 03:25:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31529
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6766
x-xss-protection: 0
server: cafe
etag: 14924840246271906451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 10 Jan 2024 03:25:40 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame 1502 22 KB
9 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 02:25:36 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9210
x-xss-protection: 0
server: cafe
etag: 13914886398874665762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 10 Jan 2024 02:25:36 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 7D40 177 KB
56 KB 115ms
86ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZYwUWwAGWUsIFUTqAAtPbl2k_PySlN0UqenGHA&u=%7CkNVRbOFKiWGPzn%2FOTHIIQErdWCrk3jJxHhrU7t045io%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUETQtbu7-RuG02-JTbIw6iQcfCEIzTmgNg2xIeFvE2zg8XkuuHkqd3jGvB-WiGeKVVgOpC37Ra6cHhKoLCfcn590kVGy8RSOhbaQ1Os-rEvAXcqrwcbUePbeVCXQSMZzyaorEaiJTy49uVAGDzevyWVtp7C9R7HS6fuIjgjvOPrNOsO1HTmZTEkDEaiGlT11qoy4bL5MKLK5iTMcBLo58wUBZgGcrxE9gMF1IUkbLyI7BjarvzrzYp6H_hTmsbbi6TDpaacFEsoRWJd02XDJteWhfiGMX0dVrJ82S-8HVF8M4vtVNqGxsAE-Bz4hjWALDVe5v0fR8Txi7AqCnky0G3c6cn_4ZLJjmqPEbJz47miby1tAv1IBRsxhiXJZ2cfM3ylCP60Ka9zY0txTlzQObQVFwqey40FFCE3i9rqJfKaBJxYbdJ1fF4Y7--fFBg7WR5HICnx1OpQ-_WLQD4jr9rHZKcYR_VI-fWwknyfnW3vu3ERC9C0_MoErPq4Qkq8TxUguOelD6vYINyrODa727LceuGooHypQr0_zTh66IHduCxOird4LeUOS7KHGNooCOBLGbgJV0C2XhXHmXAzqSQrAeNI3CeS9bQvfZ8_bXsSw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCObmHWxSMZcuyGeqJ1fAP7p6tmAfJntKxXJWil_dwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgTxAU_QxHmAb2NQF8Iww4GXMSzynSccZo16btRN2sQ-YQBKR_xNnOS7sHJkUSo15XFKYkWSqW2AcWj4ysszspGUy_m-WsVVJtYQa_wt8_0r1_YtTssUDhH9Q5UQXCMF47Pk9wlKwkG0NVEte5FAbWM9xCha9eDy0pXp0o_iVaIGQpTT5GReD7-GSM6jaUkrWkcDfDbkjrt2V3hs9rqWNIH97rbYVisi_6MySBq_DRrEggeBTjGxVfxYd6C38v1Tl5wbyi4h2KbHKKtznPN9kmch797nd2OucaHp7IhcHH8te08kmk0EIJ-GdZ-dyXHZ_VUemEuABtyKgb2Ag8b3tgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpY06H_jMuvgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_17crw5z7XwwLqMKdCThoTV24QdbQ%26client%3Dca-pub-1784742484268469%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

bc01e35a5c0b675a039f1a5065450d40a7276480d1ff4c2f4a9c4f44fefa4437

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:08 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=tcFMqbxWDoCsW9HOPA8nmt19EXaq35qvijX7WSa9WH5IwwnVK9_gR8tB9Js4tAY9_4fYa3Y8SouQMohj1Y2W3e6QXiIInHzw9sFJ52YCa9riixUN6y6azV0Zp0rMXzInkTZwWAkp-NmrA4Wu0a9cbFngr3-_NvrWDpn1SWLvZUd7tkS1FRaTFitpgS3MFdXFNp-iPBMvRJhIltVrQLsd9zuVOh-ilZCXlVHENhs6QkJguifEM5a1MaaEb8p-_WanufB4_A"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 53271065
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 8B71 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 8B71 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52880
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8B71 203 KB
64 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 9DE1 165 KB
53 KB 78ms
61ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZYwUWwAGWUwIFUTqAAtPboGvnllzPTU6XUGrEA&u=%7CkNVRbOFKiWExppZ2U5CznpFGY%2FgYvCFDRI8TmSo3xmY%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUETQtbu7-RuG02-JTbIw6iQcfCEIzTmgNg2xIeFvE2zg8XkuuHkqd3jGvB-WiGeKVVgOpC37Ra6epRZQDJQBic9Um6YdsyBdjfDbnxaVApRnKr860Tv3i2i7IbE6jG3bP6ehta2XjPoowUgCSzib7ucSYfjuSb-UyhdZ4M2DZFBrq9Zf8Bj7E3TpmWDyVQClut96tO_uN3zlFxyyUX4-zJmIfthOt27uAcctw_nuEKbk4Q0b1Jrr9ay-QhZEkF6gFLG_edqI0t5TxaY-1Phd-9AYUKxeVf2VdZny_P8AhJjOSvoA5Wn6Vz1XCJnHwSzOKOio1BcKmbGBFP5JtsFww_19lMQhs3JSduqLz0AxYO43chSIgsNDWuApJ8wmts1dzMceECsajfEa28lsqRakJJROAggth-8rSVg7ckvBeNo1YJ2I9EGd_RJdST6Ocq_2i1MLlNYizPcAtMk-tDSxcb71aVoHSJkdP1XGHXMpWlSRcdt8YctR1RaQKu9M_PsGoqGn1Yd4nMDk76fCRadw1FF2VvqD7_tSzNpqOihGdJlp8JIsoZBK2WAEY4Kep6W7wLrct1X5t5q560OXiFcyZ_k96frRzG_Cw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfmtPWxSMZcyyGeqJ1fAP7p6tmAfJntKxXJWil_dwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgTxAU_QUnPrb3Bth5w4DEMdE8jJcsSJckLxRACpQ23s7yH44xRuFUdAMXhUc5V1isa5iAuLm3mwdKrBPjXa4enDWUy_yDrJ-vuOIKMzpLNNWPnk2PwjzH7vn1-fI3ufBh4_Fe261L6OAJiZop0hR6Yu36vRr1uTrpyQigp07rQ6KLPyE3UDs9wAeJpOJQK3qnzswmWwsm7oeT7iouYYTd6aekjSPiA5gKfdDh4DfC36lvIohoX2dLNbqJy5uyEF-ssPl52rcKBbKXbMUwwkeZdWNquHSDLpe9E9rnI_h-xTora0vQ7-biJ4tUWaJn_bv7cBXduABtyKgb2Ag8b3tgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpY06H_jMuvgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3a09EsLHPBpvyYKhraMAU0nydkqQ%26client%3Dca-pub-1784742484268469%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

52fd1e45f5bd564ad82a6ec81acd1340354d759d5e0dbefc768dc698ff6dcd84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:08 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=N8HE6bxWDoCsW9HOwJceGnmayBQKT0qeY1JOokZ_-gBv7q0nkMvzPUKdzY-UQqTo-F06LVm_E_E0XoCN1zwnVm01A0ykgtikfw4ECXDg4JyRxAGy6bIPdsLj75OLeb9g46E-r7fOsg2RsJpw7vKtbGtCFdL67LbB77LKmaEXWSaZfjAKBjW5WQhK-wb2aJHNxKTZjjVmK7WBvVKZyjYZc0J_4xN9GDtFei-NBpJmJz-CdcI7loh05RJaK4Yj-kIAdLq1ng"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 45536120
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 4E60 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 4E60 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52880
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4E60 203 KB
64 KB 62ms
62ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 6883 23 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6883 8 KB
750 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 27 Dec 2023 12:01:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/ Frame 6883 15 KB
3 KB 50ms
8ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.css

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29c99771c81466150d55d307a9b0e12cfdab8240a9c65a80b764c1d58965406f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 03:05:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119115
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2920
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 11:34:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 03:05:54 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/ Frame 6883 376 KB
131 KB 51ms
9ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28c5732eefa979245ff326045f37b6b7cdfc92385c594caea33e265e4a066c7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 13:38:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 167531
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 133672
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 11:34:13 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 24 Dec 2024 13:38:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 6883 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52880
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame E7E6 172 KB
60 KB 26ms
8ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 11:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 754
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Dec 2023 11:58:35 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/ Frame E7E6 11 KB
4 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CaDqqNksk2d8kzWzE7uLxoJM339YPpVVw8eygbiTmt6CZWfs4deGJB7IAJ_Taj-mOZRgsayO4HAKWGSkWYgoKkolOFcJFyouF4ompowvoeB36QHdTJEGie-7pID32i3GY6tqruxbtgopdQoGPRk2C1ceUgclKy1xzP9OM1mLnwherrE_LTHuQlQkujgMIRUsNW4zSP&cry=1&dbm_d=AKAmf-DbjRGbpSMeoB8DMf7VvLWBI0r7ELhdovYw6NKL2S_9z4NgUTsJjvNeDsyORq6sdpvTyzCIZU5u-pRc5FzHh7t4acCv4e9641u7VbDnHXZMTRwOnx7oa7XjSwTCd12F8PzpShk9WZytLYkJJO5nLuZCOzDYUdu5_HtFekhk_972MMHuEo80c5cz4OxKi-vYNOI3raqR4y76vi-PIr3pYBBvvbjLgn_DXqgwLgXGBgBDsYcw5OzbJ7t4NjuGbKdlL3pRbu2IkQlLnTDMftHI1ED10YKaYB7Wclvnoqjh_w9ZAHMCHmNRzulUDuTgvktiwOzDqqxuno9gpJh1GiOKQ1_C0KlfQJ82r-EngmjoJF-uBdpJQlnByxgn7xZhn4Xs-Io90IIrSIaZJA8pzCkwBmD3EV6L5xG3JxmPcEb-k8KFsH7rtWKvCnHHdgJgEl2Ukm1wl0megzgu2OFbMoYMIknYhjG872DC9YHHfAseiXUtNLnOphdmjMHwPssWaFqzt6x9Hz2EETBU5GOw-YPaR6Ce3kvR5Sx-k5-LfiMp4x0CAWmbDnJgy9GVoyrZzman2k5taVzw6GgVVqQXr1IpTn22ch0EV2ifI3hcsxjE3rGLZnfSkSvwiUCZqTv88bBDzzxaioem0M6xj-e2J6rCJypgSFHnEHAu1TOkah_Lk7BmcuOE07YTlBisRO1SCQH9VTvdUfKF-iVZZuAUPfSsTISAg6Gq76g1rMGPbHV13Sfu4Zb9c5CHfEKMMAfpZ9Non2xSFVIszEkIjgYNLVY6VWZEqf5cEtnwlr7TvcKymCoqj8CjAphTMIQaiEb54w3ZtOcf1Y1ECl4dXZHIjTts5v0Kw1x_vh3iu1iJGl4kSct2MS98cmgaxp5XHipANuTD5BRlpkA-CsKw7M0nGJqhQciaogzIbhAcKpwFmdSTX_6rsouviv1lrIrw9g0T_bRExHMws-kCfGvTBaLHrKd_lqfLJSPM9IQ1jiqgoU5iR9zRp7uN-C-c03y6WEzaMljht9QKu8cSXZrQT9Ze6n4rSox0pxYOWS4F76tQ2YX1cVuL_JxAiBP0pASzVy2LuM9vsawr5FdvTCa5kpG36EBD6ANpW1cW2gVX-fUYhcZaUbGAgd_TTiX9ZL6O6CpFG7ZxjITJh0k9O1SHsl7VR0fCJYGEGgLe46bDY8eodkwZHbQdiq891Icb0LJ0HOu8PLp9oCrtSiKEm9h55V-AHD0vlovl3yL4T9KN8MqR474UaFa6USveK6COQCKrTVtMSSiIn3IP3k5irlmy0884yP6z_78rcxQtpfHWTqhD2ZTATCdowbnXnXDSMQIj1TiGt_p3cP01ggu1qSd-CECs94knVeBeYYxWTpyvvfUJJaTgvC-CSdXyAMHXXs9N1SmoxjYLE5fsTumOymKFxWDci2oefLhRpHYHinsYMlC_dmIDZlaUfDs-3-jCwYMydND2604HG7dc764JlN_IZtChHN3_o2M7MTam3gPIOiL9Bc3DUnjyAhUnamKwHM5VTM-F5x3Fl5TrG9sPkj2nlAsbWiz65KIrYNY-TN1taqhsJSQrj9NpKY11fU1UocSB2r5O6DLqxluVPnZsBsowlKcmmwuosoBwNNZfSsxW1Wg2YRX-14RHLTSWhFaHYLLITjnVpIQ8K_ZYGRzZ7pMlKvKYXmlT8TWOdfRsaWR95B9fb0_MLD9CJVE-1KQ92cgfmjvfoQId2X9YhSpknxzlRfjpDWnXn48QQfON6728-UoNmu-jEnloKBlfmXpKjoMbted84MAa3GEcNfFcd5P-1mLrwaRRqBoVsMrSmHIL17v2EQb2rX6zw4lCJbLhaWqsHNVxHfWHkiz-HDbBTGr93kUuBNuR26IV58jj_nYZsVGrUQKtq4ZhNdGoRDoieXN1N1dxMYU1w3HoVx6Lxt0vXreC12Rk7MCdU4MhMGz-vvMd4Wso8mJFU8QGlsyzN-ZQTR2u4XGQi2QcILeFUr56MfIqyR9ZGvIzlp2phhfknWGbpyuwfqETEkHSiGvqER8lifkIkl6GdYJJm9dPHURE4kHPm1HaWAubrQ2IG3rUfP7YAWyAQHC1zdXJkIZ3HtXdP_hoaAzQk69Nt2aqU5A9tpQfpb01hm6OzS9EMIx9v7g14m268s9znkJ5kJIYwmSqWHjO2_6PgFqXLxEcG2wbIKF-QTX3JiaCgsYiJzQZi5lCEZL0IgUbsjb6xGRX-sh9LVM9iJc_hyzRaIU2Uu7fadqPuh-Iorua47fJZedh6n6MWLVAiczBfV-td1RVGoSRr7wp_s6SvTHKZ548buQThB11nI1W12XFadDcZ1r9WHtnsq4YZ2_lsIs_qeQXL1_KnImu-ekLRsPFCrKG68q6rfCakyIXPvXnbIgoSvs8Qlxbc0QRj_k_xYpbEwBlT94KohZNpqaQV2KjVrSmJ9Jia8-obZaJeTjEAz_VlJTRIhkdqpujEYyvL7-8C3bMJitDGxFnk9Tmpcx4LmPj8JvOoR1rc5MVFfdCf3FEe43myUjqQsg2tIo8n9YU2loJ6v3x7TdInIrxYLUJAwssDKGXY9irfU44TqCRV6QDbm-SJpKo6UF2JeGh90_cuAB_1GVLzu6ZZUXI1Fg6rivjsfKtiJQHLYyFKuhAseRUlcgqHYZu8iQlRKBE7pznpF1tKnaGKVjhU8pMdyTE-qqHXZczDyBbwWfNolNts-tbs-7tBQOYlC52qIXD5j4afuw8S4-wBhSzJqzjp_3fh24N9GWpQtT6CJVZpriMXFzeGrV7V9tHIpYU7Ar4ww22Czp40wE0llnDfAVTwI7v4r_fyS9K1iVrAb6-6EjyNPtleAU11sgYzve5zGaIGCM2EEwPhVbX7Cnfqt04skNb9-hm9ke3I7B2bYUf3wAQVmg9uDtVhZ2MWozGhUYE8EAYY5nwSs1e0jpqzMQrVxtZ4jnnpMQ71KIFiCRLek_yi6POWYpA4cybDe4gwT8XH4UJevhSJxjb1SRzLqgk06lBwoz8QYjtBzmjZI0OEiyJ1e0ui_k0-3NRjvYEbCfWWckVadgeeVopBIqHIrfvHxYb9h1weCHeEHTIK7_YRGan53XT9D6lNhVRWIb62_oP_Ta92B7gIRVQwP7W2BUViDRcLm4hfGWirW5Vr7EnHFGWDczGeuRXQARgBJHoWLpURH8Db3qT1Kr1Tq3WKt23fXQJ4ZpVh11t1iqTXWaJHq8O0GLidyRf34AbF5R6XymJG2_55sXHJtdKa49rB_yZQeZNZrSkNuDWZ8MVmXXHqGs6-1VBYkiMus1UjGbMAR0ML-BuT6u011h5Sy6pzFkEDfvJZPSRshB0YbxKEOIeaP8b0FCyag-sGetYAw3VHsvRUNaBccDWws71KxXBZGiE2ogOHJ5SANOVRMOuqLIBvfsYepiy8ZJbV11CsfYJblc4wR3wZXK0mVTIvHGZRnVajUdunedd4c5wjRwkh1dDA3sLzrzo7CUw-ZfHFBwhg4o9CNc-s4MUpdDYJq3fDaWZ1kHgbF5hgSth5Bb0Fa_HV0ZB1igvD79KXP_U4JGlVDv_eUmjjtkRi0oS80C0nAhLVtyX4IEZhv58Lo4_m1ZH07aDSlF0CTPKO9ixgzrKUUsZUlI1SOuJiVw7tY9FrxtBrM2E0tRbTBgDQoe09L6GT33Y-kW-R4jKe_Bdad4VZWXu0d1dnckKuuyMprMTS8mNBpiO9joPbz2N6fG5hzQeVqR1FQub_Rfkg9NUQiE23s9VVPtk0mW3DW6dKLoDc7IftmXsuBHExbEO1h7F_P_W97CC-fL0b_RL23I0nLaP35vVavyOTilY3EHL8ZeJE-zv2mtwRJ0c3mE2sqpZQ6kxhaKyz1aij8d5Zh3ocCWROg_pXqnJzd6AjNKeR3ZK4Nfdu6HnPDlByKTLC-3D6_-BpD3GkX2alIngLxJWde2z9ESwEPdUvttRbqUuNmnXYn8Mm3nvuIuJWGgxwYFHed9DYb6X6dZ6r0rWtTbifF5CCkrcTlXx3vPFLU-OtJVXIfsXzjPCjgcaUiBQcuHSG1jfum8-gQamQ6C5KQaMp6u3354q7_61UTIC1Qcc7i4TI7GIv677lo2Ch_tKX2sFmTtLpeN_Ozb3VoEGlV3bnrPn2rTlY06Vmbpj21XDm3Q8LbNlbPiUcjn-KMRjdW9a-ngO7Pj8cXTsKVTYyyAuT0tf2Q-IzP5Rv2rm18gU-_88lcUzSZOMjTPAJrLm1dMn-jZIODVHNWVesZtpFATKbELoTbg2_oX7oeJaqjRUSfMyRxfj8lbDiJDJFtqg94fBlzAbS57zbyjYl5H5giS8ASEujY37qp6zqlWcfPruNcDcE3yPxgd8xqlyzwU74WpZXdoKUWGNowORT2iSqpCN5E21ftLSyzv7WDC56NXjsgxpYg316QRMjwp_&cid=CAQSTgAvHhf_sGYJblCbIzB8KY1iaGFR_JQ37WJH7UmvgcNoLsBO9YlY4XLbhPkAPmZBlSnTAdywPHi8mCpqSPwIbm54olAqBuaTGAmHduH6VhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2F&ds=l&xdt=1&iif=1&cor=14742596278492654000&adk=497053792&idt=130&cac=0&dtd=16

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

712bf11a3755c81fa1ce57249e7a61f6845b843b84aea09889a11478515234ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 03:36:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30902
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 14415875674906819925
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 10 Jan 2024 03:36:07 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame E7E6 31 KB
12 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55722
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 20:42:27 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame E7E6 41 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 13:49:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 13:49:16 GMT

GET
DATA 200
OK truncated
/ Frame E7E6 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9089fc84ee5e1e712ce2de36fd2780a6da4b98dc286c29234486ec82022c18fe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 8661 14 KB
1 KB 19ms
18ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 27 Dec 2023 11:10:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 8661 2 KB
822 B 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52880
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame 8661 23 KB
9 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9844337d0b1b36b45473c8fc27cba7d1c9f8aab2107e23e684b9e1a48e6066b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9269
x-xss-protection: 0
server: cafe
etag: 11706523405290302210
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E146 143 B
166 B 9ms
8ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2491
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 11:29:38 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 8661 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame 8661 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52880
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8661 203 KB
64 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 8661 37 KB
15 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 09:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10656
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Thu, 07 Dec 2023 22:13:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 26 Mar 2024 09:13:33 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 9DE1 2 KB
1 KB 254ms
26ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZYwUWwAGWUwIFUTqAAtPboGvnllzPTU6XUGrEA&u=%7CkNVRbOFKiWExppZ2U5CznpFGY%2FgYvCFDRI8TmSo3xmY%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUETQtbu7-RuG02-JTbIw6iQcfCEIzTmgNg2xIeFvE2zg8XkuuHkqd3jGvB-WiGeKVVgOpC37Ra6epRZQDJQBic9Um6YdsyBdjfDbnxaVApRnKr860Tv3i2i7IbE6jG3bP6ehta2XjPoowUgCSzib7ucSYfjuSb-UyhdZ4M2DZFBrq9Zf8Bj7E3TpmWDyVQClut96tO_uN3zlFxyyUX4-zJmIfthOt27uAcctw_nuEKbk4Q0b1Jrr9ay-QhZEkF6gFLG_edqI0t5TxaY-1Phd-9AYUKxeVf2VdZny_P8AhJjOSvoA5Wn6Vz1XCJnHwSzOKOio1BcKmbGBFP5JtsFww_19lMQhs3JSduqLz0AxYO43chSIgsNDWuApJ8wmts1dzMceECsajfEa28lsqRakJJROAggth-8rSVg7ckvBeNo1YJ2I9EGd_RJdST6Ocq_2i1MLlNYizPcAtMk-tDSxcb71aVoHSJkdP1XGHXMpWlSRcdt8YctR1RaQKu9M_PsGoqGn1Yd4nMDk76fCRadw1FF2VvqD7_tSzNpqOihGdJlp8JIsoZBK2WAEY4Kep6W7wLrct1X5t5q560OXiFcyZ_k96frRzG_Cw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfmtPWxSMZcyyGeqJ1fAP7p6tmAfJntKxXJWil_dwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgTxAU_QUnPrb3Bth5w4DEMdE8jJcsSJckLxRACpQ23s7yH44xRuFUdAMXhUc5V1isa5iAuLm3mwdKrBPjXa4enDWUy_yDrJ-vuOIKMzpLNNWPnk2PwjzH7vn1-fI3ufBh4_Fe261L6OAJiZop0hR6Yu36vRr1uTrpyQigp07rQ6KLPyE3UDs9wAeJpOJQK3qnzswmWwsm7oeT7iouYYTd6aekjSPiA5gKfdDh4DfC36lvIohoX2dLNbqJy5uyEF-ssPl52rcKBbKXbMUwwkeZdWNquHSDLpe9E9rnI_h-xTora0vQ7-biJ4tUWaJn_bv7cBXduABtyKgb2Ag8b3tgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpY06H_jMuvgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_3a09EsLHPBpvyYKhraMAU0nydkqQ%26client%3Dca-pub-1784742484268469%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 9DE1 2 KB
1 KB 242ms
14ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 9DE1 308 B
636 B 176ms
14ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 9DE1 293 B
621 B 176ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 9DE1 43 B
348 B 177ms
15ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=RSgA6VpK7UNOzZVT8RZfYtdX4rATEKXcu36wrAUbvbrTpU_hd_kQvTQ8ZpGWyNT7yEQBjF004cpQTRLT25NxlYhzJjQkO5bemXblToEah4Mxkmkh5s7rbMIclj-eAtaRIsYShXV4kz8QADJLlvW3Z4Gmu4AJJPqPnPxRlShIzJyYCA9LaxKeHoSRgT5sudJ-67Jmz7u5mZZNyvu75AvR4j_Ltt3tcrgOi6gkZhJQtXGzlottRyC1SYeXoi13-vV4uK4wp8zKz0RnMhLrWQ2YQO5dloSmLFaHaFp1_VxA4An1asyY3XsgL8sLKek0cM11LJB9wJkeLIxm5NlisO6uAbu9vFaeKbjNNAXPjQhwUnGweVs7ae-0xYf9d0uQk1HlK_lNmrcIX1J6fn5PfTihyCuhlNM0bD6m46aHcKjSgbGVdS2_hJhJdaOOsRoD3EK0GU9J6w

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1738205
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16661873397665731963/ Frame CB89 72 KB
20 KB 43ms
43ms Document
text/html 142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16661873397665731963/index.html?e=69&leftOffset=0&topOffset=0&c=bvb13SSQfz&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c65241f6f6e84f27b23719e904014b1727514d25b065d393350f2e2f3c5d148a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:09 GMT
expires: Thu, 26 Dec 2024 12:11:09 GMT
last-modified: Wed, 25 Oct 2023 13:43:03 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E7E6 0
0 255ms
52ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstbznE0oNb7EIsGtIo-F7akrYUC2MNsIIhJwBCEX4IyBxZP2ISk9DOcgOGr4d7-olvIWCcJDWQdjapAXrfIQRWKpynQhou5mPQOfw5GTwrp-0ov8IcZgIw33hun7M2Z7yaqlGvLhFxnvtGMpcdgwdAhPxW8eH-g2kZ2p826scVYYLq4IsSW-wJlFcAO2fw5FgMvYTivl2zoZUnYb9nNgzMaIFhJsr68_TecGRD-g5SCDbeO-Pxtol-bDLYEws57ma70DjtPjxIeXLwuouHhwMtw23TChjE3iFyKwsqNqmseFDf8QurXHWlAJqGtQ33kY276Pn53g7GQzp-1FLIn5uzX5FcQkzIB40FAMrc4aF6lf3fEIRc6Bq20SS0Iu08fFrcmYAw9rbFIB7QFdbfeIhsX_-sHfQq4RbTkGr99gPuKeJazyLRpmSgstlfXh5P1oeL-7aoZ25RWXCLosZD-4V1ZcsetWBH57v057VjhVgE_PJdyArnlYNXmJXBwOVcficwp63O6Dox6EghDVxcFOraB5xzF8Yhlqu8iCYcdWPSuG-RGcE5j1eK6M-yMpanMyrr5jY7FOupUGAimUjD2a4da8wl8DRKi9ApydphizoEAvlAAFHYwXuDe8cpRhzeQbpv7uC-EOhWmtez_wBjB812C2Adki3afkmzzMENjD1Kl20yh0yd8xqxOzHoXkN3t4AwAOHzQWgNnCyy3rEtgbpf7P8QAdlB5wXuGXkCX7nR-OdpIuIf266j9-_X4gc-TpCeRWDXQcvNDNc3PTAUslvm8u9H7FMKfR0hbNsObfVqSP4E8jBFHz_dzlQjq2eCYFVFkvnXptoWTJYiQtE2Y-noj0pjnCrXUWF49eEnA2tZOZjRnkVgYxBmv6tmWAm7D2E2qQLempM_GT8dImRpuv_rkQqyo5bqSHM_QiMPYhZj4rWSvNCPNoy8hj1N599c9Z3qY53NyhZ_ol8Q2GwY067MdpL5KclGq-vRSwECBR_X8NgpDKOUpVULmTRClc-QyGJnjWaBgaUYOHvzIT0u5L-E13WqVAFcAo1PyiV_8ehAR2jnjCeCdZCN_HTWBCvMKY_JeFy-q9QlTMjpTGg5DZzmSt1NCh9lOl8Sr9KN30vZ_AGK0za3y4PCB94ZmTsC_ZJ1lNyrUQ1mfguCLmSemmsQSWtUiMOO_rT_0aUHMJ9BR-aRua-WIXKxrmWhODTHfMsNyENnYwjP1Ks53aw9ySZUKOHbIhoC2FBZ7LcYNg1KKucnjX9H0AGtETM4wkfLD3k6hONQgMAmO1rIR64V1e7v4YUk6kcWjiZApPBxOFY7XNVTZa4x6VUIaRxVXufM6npq5KoKbrLcqDm4BvvSD9V-s2NC4k-FrBQfy6AHYsESb&sai=AMfl-YRUAjJ5CPpRbblRsmbB-xArNNhKJx6ypQMslr4hFnCwuSLwz_qlwXGc7KIVJAh_tkTQDf4_tcvH5zCN7ohaShfM3j8ZPj99VDjVG1-QFbNfJnyjI71KKLr4qJLCySrG1L8X2Hzt_gcVFqFyktP6hpeaOcsoDLUaQDuaOJJxgqtlvZcIfhZTmMR0Gp7GYmGIk8-99SPLRVEfYHM3_gbabDfB99XRvoelfXikRGpk9VS8uPXcebTYhfXgCbTBThbBE0Z9zYsW64XaLJ36JbpdhLP80f7Q8xzgV0eKfg&sig=Cg0ArKJSzBgQvyFkb-EEEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=132&cbvp=1&cstd=122&cisv=r20231207.80544&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 18E1 38 KB
13 KB 12ms
11ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78630
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 14:20:39 GMT
expires: Wed, 25 Dec 2024 14:20:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 7D40 2 KB
1 KB 201ms
12ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZYwUWwAGWUsIFUTqAAtPbl2k_PySlN0UqenGHA&u=%7CkNVRbOFKiWGPzn%2FOTHIIQErdWCrk3jJxHhrU7t045io%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUETQtbu7-RuG02-JTbIw6iQcfCEIzTmgNg2xIeFvE2zg8XkuuHkqd3jGvB-WiGeKVVgOpC37Ra6cHhKoLCfcn590kVGy8RSOhbaQ1Os-rEvAXcqrwcbUePbeVCXQSMZzyaorEaiJTy49uVAGDzevyWVtp7C9R7HS6fuIjgjvOPrNOsO1HTmZTEkDEaiGlT11qoy4bL5MKLK5iTMcBLo58wUBZgGcrxE9gMF1IUkbLyI7BjarvzrzYp6H_hTmsbbi6TDpaacFEsoRWJd02XDJteWhfiGMX0dVrJ82S-8HVF8M4vtVNqGxsAE-Bz4hjWALDVe5v0fR8Txi7AqCnky0G3c6cn_4ZLJjmqPEbJz47miby1tAv1IBRsxhiXJZ2cfM3ylCP60Ka9zY0txTlzQObQVFwqey40FFCE3i9rqJfKaBJxYbdJ1fF4Y7--fFBg7WR5HICnx1OpQ-_WLQD4jr9rHZKcYR_VI-fWwknyfnW3vu3ERC9C0_MoErPq4Qkq8TxUguOelD6vYINyrODa727LceuGooHypQr0_zTh66IHduCxOird4LeUOS7KHGNooCOBLGbgJV0C2XhXHmXAzqSQrAeNI3CeS9bQvfZ8_bXsSw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCObmHWxSMZcuyGeqJ1fAP7p6tmAfJntKxXJWil_dwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgTxAU_QxHmAb2NQF8Iww4GXMSzynSccZo16btRN2sQ-YQBKR_xNnOS7sHJkUSo15XFKYkWSqW2AcWj4ysszspGUy_m-WsVVJtYQa_wt8_0r1_YtTssUDhH9Q5UQXCMF47Pk9wlKwkG0NVEte5FAbWM9xCha9eDy0pXp0o_iVaIGQpTT5GReD7-GSM6jaUkrWkcDfDbkjrt2V3hs9rqWNIH97rbYVisi_6MySBq_DRrEggeBTjGxVfxYd6C38v1Tl5wbyi4h2KbHKKtznPN9kmch797nd2OucaHp7IhcHH8te08kmk0EIJ-GdZ-dyXHZ_VUemEuABtyKgb2Ag8b3tgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpY06H_jMuvgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_17crw5z7XwwLqMKdCThoTV24QdbQ%26client%3Dca-pub-1784742484268469%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 7D40 2 KB
1 KB 201ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 7D40 308 B
636 B 145ms
26ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 7D40 293 B
621 B 132ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 7D40 43 B
347 B 134ms
15ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=Gr3wU1pK7UNOzZVT8RZfYtdX4rBd-TkkD7VtyX8_2420QpDJqM47CCzWpwDojNbMCnPFXUa0Ee0rugzAL8_uX2sA6QNpU4Ds6o9M1-C7YMxL28oCGOA6GITMSSlfVkP_PreDUDArr9DgeHI4LRj1dkD2Q4j3-W7dSBZyFf2ewywmt8_wesBYJauWgJNWJGMyX1B46205lbGerVdhqR3fk8gh87bRex96ksyzrW9qWCBrLSM_zV6K-3nYSFtTze80KvqA1OHk7-4iLZCKBrIPnKPDftGoZMwAl9CmKsk8C2OdzpEtyZzfkHaVdgSGnMw0AcAyqBDrVTJFVFTLc_iqnu1f5veWHAE3WBqcD8B82grZtxkzKDMc0_jZCbdP0e3iUn6aWR6XARUFqnkNlvsvcR913lZ5kIdU1OP-pjx4fJ_DtHpQHGYCySSCS48Rg7_BIpFrMA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1854605
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 9DE1 12 KB
5 KB 182ms
24ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4855904
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yhXY3vHAsY%2FfRM2w974cZa2ulBUZEC2O47%2BQ9kj%2BSPr8pS70AAZ%2BLIUsJPrJb3TpKbmJf1%2FKp4D2YrOgOcGNmGjKMaQMllgV1QvYEQNFUlroIqZaX8V%2Bbii6a83ety6P9pteHVTmFyJZPAl70h8cON2v"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83c176e829c737d4-FRA
expires: Mon, 16 Dec 2024 12:11:09 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 9DE1 12 KB
6 KB 179ms
25ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
54 B 798ms
271ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lqnqj345&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&sei=44752538%2C44807615%2C75259414%2C420706098&nsei=44714510%2C44729911%2C44730425%2C44730426%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6883 9 KB
10 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a84eeee6a25e7c9a8a03191007a6720566b5a2aa2384d36168fb07f49e97e9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 19:27:41 GMT
x-content-type-options: nosniff
age: 405808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9644
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Dec 2024 19:27:41 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6883 15 KB
16 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Fri, 22 Dec 2023 16:39:21 GMT
x-content-type-options: nosniff
age: 415908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 21 Dec 2024 16:39:21 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 6883 15 KB
15 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 08:54:09 GMT
x-content-type-options: nosniff
age: 98220
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 08:54:09 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6883 0
20 B 49ms
48ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=ClNH_WxSMZc2yGeqJ1fAP7p6tmAeT4ar5dNO1k6aYEs-Ph_mUMRABIJKygg5glaqzgsAHyAEFqAMByAObBKoElwJP0EcO-xfnI2hCPV2jo3jfDDW8KK6JclwoxCjxGbk1hcg0qupsP6wvuMU8M_68hDxE5yFGJu-FpnCK4CSYQfW4S8KSXexA5ucXvwlyJAEZq0xpYqbiZqBWD_el5XVp_RfXMFjka3QjJlFZS7XpZqfB19Ua6QmAVro86uWHycoS0Jc8gkDGYu8GKAey9uSNwPA_kDyG7hsq_FUvFQ7h7HMLYCsImGXiCNuEW1JsYY5SH5yDHtsDisVdMn1XG7ZcANdNsn_G02Ps5H9WuQQpyHUmz2glFLPUEbytcaCgC9O6PPkooFxOU2pEj8zWM5RxcbCyyiJ_Bg8-mmeRw6ilmqnbNUUGrtezCbIUEfeP9rQopFnxt3TwucDABLuI28i-BOAEA4gFrcWtx0yQBgGgBk6AB5qS6NUCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY06H_jMuvgwOACgGYCwHICwGADAGiDBQqEgoQ5LSxAu61sQK1uLECrLqxAqoNAkRFsBOgwoUWyBO_pMTjA9gTCogUBNgUAdAVAfgWAYAXAegXBQ&eventType=clickstring&clientTime=1703679069324&ai=ClNH_WxSMZc2yGeqJ1fAP7p6tmAeT4ar5dNO1k6aYEs-Ph_mUMRABIJKygg5glaqzgsAHyAEFqAMByAObBKoElwJP0EcO-xfnI2hCPV2jo3jfDDW8KK6JclwoxCjxGbk1hcg0qupsP6wvuMU8M_68hDxE5yFGJu-FpnCK4CSYQfW4S8KSXexA5ucXvwlyJAEZq0xpYqbiZqBWD_el5XVp_RfXMFjka3QjJlFZS7XpZqfB19Ua6QmAVro86uWHycoS0Jc8gkDGYu8GKAey9uSNwPA_kDyG7hsq_FUvFQ7h7HMLYCsImGXiCNuEW1JsYY5SH5yDHtsDisVdMn1XG7ZcANdNsn_G02Ps5H9WuQQpyHUmz2glFLPUEbytcaCgC9O6PPkooFxOU2pEj8zWM5RxcbCyyiJ_Bg8-mmeRw6ilmqnbNUUGrtezCbIUEfeP9rQopFnxt3TwucDABLuI28i-BOAEA4gFrcWtx0yQBgGgBk6AB5qS6NUCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY06H_jMuvgwOACgGYCwHICwGADAGiDBQqEgoQ5LSxAu61sQK1uLECrLqxAqoNAkRFsBOgwoUWyBO_pMTjA9gTCogUBNgUAdAVAfgWAYAXAegXBQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
234 B 783ms
270ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lqnqj34d&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.1i3&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 6883 28 KB
18 KB 179ms
57ms XHR
text/xml 74.125.133.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-CFrAT5iIQwH6S6zVk6iS7pMGxQZ_e6sKW0_oty_vVUh9SO5h9_Su4A4UsVvVXpOH039cxPQ5cE9eoQsE8im4WIVyo4nA&dbm_d=AKAmf-DS33V-ExRyAJkL0BehKVdoj9FXh8BorHl5CW6gK9FxMo0cq7mrHP9VhLp1--oDl7pqkbCCubx4KjOZYmMJBNJwGwLU5y9Wt0YnoxMT_Hkxq3YTiJLi-RLj-y6obzNok_1n9pybHm1grtKR5fRk-OwIF7W0uHteSBJRE5YwEeQY6BEHGysIyi86R3RZ6_XRkPi-GqK4-GC9HMpamQT8ac5QJ9yTQZ8RU5H56aUZC5YvTC0N9RJsRj0iapxDEklElZd9Dz3m9h8tUat0MBb5M2mHwDknMzOrjxsfxNyE3i9Z4iR_ZB0WdqOxcN5fd_fSBSfocerLvFwbxaDgReyjXU6rFOA9YYgwFyb4qOi0FQRY9I3aYGsM_bQozf6mNvhbxtTJXT6pu08vTcJOVoN-sUNKxmkalww1oFTbGhW9lz9SY8FHMrrE7Z6ttxcI63M4jkX--JbM8VKVcD1CXPwKvkvgtKA5yUIL4wyM0GPivME5tA3M9NPW-lUZbOvZ1RqpZk7h4rHETh05rBxSVQEIK0LpW2KNnXHt5gNpl3uW7VbfWrc3rLNKPjrjC9hYX8icZPl_XgZoN1skJMBGePQJBd0A--9kn4T9Qr-lUy3MZGXGUVnZiFZDGWpUeNh-leiWOwygg944PIzwTzNZAZ2CPvkDYjeREfsFI4m-AoFzHO2k1UXIFEch0a2UOlHQUJeUp3ZoGlIhFFprc23E9pbAUXRdnphzHODp0GsZwTqvn3S5UdkABLWSLjVQidRR21xJcpwnMBiF7FvgUcJELeptIADlvESJTdL9QIyCLhkouv_gQvwYdz1vxe_0LxkSjdBV0TaOrWoaGMxMN9075o5yPgHED1TpEcfhlKXZHv9KXxMchDxhVnjU0Or0d27fDYrkWPwBw5QN_0o2jZH76QVdWTH_x4SLorKaAOTwHj2wV_dBTKJnMXf334hPHtdg8sWUNmOKakTr1GFLjB-wFjmSqqBcs0iddLdxWaWMHpTfLIcvVASRQRPaseE8WaaGevlfh4bGgKTIvw5XUNhOaL6Owrgh7NYT8JMrqYbBS51DhklRGtYLoc2eVYTmx-PlHMFRnlkuYSk_-OmZZBFJJ-OcUv41pvXzFlzhXRk5APWpu-gS_PdsQHE11xuxB4jXwAf0q3deNmmRzHigF4fwe2Y3pMc0iB6gjUmicu4HfUkgggNa0F2o0W2ekDsc5bSuUxfl_SEYuRXZ-HFZsMSAKilIHnubJWMluCtunObia9hoLj-LxlmM72_iZ22dXdc9mQhL-OCWTsgMLa9WLioS6ph7sgY4UtHKNj2vcAdnCzGskImsg2y2a4sooCVk8DuCIt5hpUeUlEtgMsqHTTrwuGbU4vHx2N5-WtIKbI7k9Ogq034OUDQrTkpKV05uMGKiQEU5hqfmk6IjJe-OnWaXNqycmM2KqYZ7y_d1qo_wEeoJJLYl_-h65JEhsc_Pr-RBK9p8Bnm3ZJeAuuxshXpWXTfw2K3r-pdmxCLZbii7R_ETpLZBwfYlcrWIMwjAALc4CEjlUvmkPfpxl9HcsIS4vsUlxd697wwqDej8t0NVmm33ZLIxXts8HwsqRappWTS_iNxJZb2hSX5qz73l3hksgREkzC_UaKtvkDoBFbGKnUQAJ5qY2jXva-CwFQ-DYLhvV2jOgycmXiWge7o8JUZP6tzn-XOdhovSiYdg2rVPZYFVc77txbZ_PCU5eWvYkH9ZVidDBrMCc0Moi6_u7XkfOKD_H4l3Gn06TBJqkMzvVz2Jch5mDDClUUHbowxwRhcejkdyh33L7NwNHgefIvAGLc2mocvw79WAgLuBkKBGgE-lFIYSQkPERxPLWoAvcymJJWjq-v7s1NtS44l6giCsj4JXG3eyl55HY3ryjz0iPwJozZKADdatdG4eXGR7zQjwXWISHCUOTo0jOE-0-k96SeP6KpM2o3AgzrML1ZZefs4TZoKvRXEAUdojejEp6ugnpA2Xq3Qx5T5vL0JP-DVZB4ExqAUpA0CpS5jG68fD6pQqJ3ljUFbro-srMrYwnTznlR4IjDZ1GChng5hfnYwD6-aUwHfu_HqMnNr5ydtdZydSWBsM2si3zMuchLV-G7gUWLHHiZ16dMpy1MvUZNWLbNDb2UiD6uq5_yqf4zkcQrPWmJPJjg93CVu1XiBZ7Ni0SNk9MrKcm1tZqLe7fBAiIEvpr5E4GMohZbgEqDiXqJvSSN265Y14z6mX_qzAOPMy6Bl5W0avYZh03L2qlR2Ipe1pRMvzrBk0GdVxSVg0SMZp_MvIO795LbnlB8yaKhplNfcxGIozrJVTDza7F82anNSJQAqXSo-DG5QZ-OtG6TTOvg8tKsBpJQ6RL1ULdWmfZh_orKdCJrvYvn9YaVqWo8QpYXTDXMFAx3UtnBnrKylSYfOXicjTtHEMDI3vxtOhaBI6vwH0Za3r6mrsPu6hH9dJ-PGuk3xNXM6zLG6SuKmkoU6HDoRkSFx6D_d-PGK4PTxHbGWaIrhe4p9FGC-eS_SILzCx4we4lxW-WTxzccQ7NvRK1Vo-l_J-lAO-yX7oNbO9k0Z3oi8yHH6Ss-9Y_6YYxXxSXohloV1K_PF0rpYyp0Vw5ScXYg9StY9arvNqCO90z90ECf2lZzIKZUpkXKDjQcpne78DVV4TadtLM6tN36DNkKfIvYyaG5LDVwo8UsBpviGhZvI4vAXAmqp-i3P4PMzx6uI6YZZtwLc0vEtetcccja-3iKF02y62kL6iD9N6AijADHEc7SVXyAp3kPsuuakYKzZNR3l6ChRFiyWBCchGCSDFq7KsT66DAb6WCCo4PV7-VgalqdBtU79H8klfzZ5OH-xqvulv4RLTg3xGdha6f79W6Fp3qMEZ_Xr5QpsgwJpLfvovtmMBrgl4q_9jprKJiLJbeMMGMgeLENuJFCpVw0I9KCtfsiiPuVB0ZZZPE_HVYZJQ6rbfhNklZAtU4GIz_Lo9rF9vGphir1vOj3KTEk_HDsYyq1iKAtE-J3J8kkOWCcppFKnVmVoVsXu-9a_4qq_a0QfQoKI1S2Ehm52ojgmWgptJ62I8_GGxH0DDKWvXRWUWw4BHozjJhYr5KBieFAIwc9dvjcN2EWm0j28fnZBNdJ5cmFMfnu3gG8PXJmooG-1An0TJYHAzA0nxVNdWjSNGO69IciAtlWAiZfGr2JsI290uwpbInDizGuGXBOanzaFtRymb5gQ7hAI_U1t7Hg7m9aYpmCBJ9M6gq5a-wr7_G0496QQPo4TVIp5TfSdca_uL-P-tQqVw5kruNIowxNZwxDpOvS4fuuOkg9UWs387pZ7pYZI4X9xeqZtykFvQDcMJlh61iG7Pr1fkqIQpMazNYumuL0wmoNiKEFvrezmDMvM_epT0w_XqFa-Z-sybD4W7hvcbVXE9wjGdXx9DOmlUR3uTmCvn1jaI0UGzxRfLcrYbNGTlNzvN8o4ZfdU2ZzIw5YwNmJIRCdpWk1XUu0fhlmq11LokZE7zAxv2jz3wUuVYnAdZviEZDOo97TsyKW-Jd9nyi901h59Rj1QspqSk45Cs3J2ETXvFO355qLUnbMmqkFkUkrpxy50sjSAhbjfO1J0w90qGR4d1avOLL2HYdm3F4LxAe30UiFioEjtaljKl8puacbGbAHTcViIJpNQJKLQPLAPET8LOl4zgclywBhcXaPnJ3CShZYrqUKbxQ6WoXscbp27MXOzKW61bHI3atBgJhsX9OE3ZQVlCuUkwZ1UKAreMVqm8tEh6rUXC5AA&cid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4CeKQXLA9bJVaZFlgIrMnDuXqopeYV2GSGBjnBgB&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1&nel=0

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.133.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wo-in-f154.1e100.net

Software

cafe /

Resource Hash

a6e717b5d8167a61c7a3fd425554b28fb94246094f89d62f238f35ee353837b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17662
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 7D40 12 KB
5 KB 137ms
21ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4855904
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N%2B6xY57o5dFUKxfqdbf56MMmDy4kMEuezS48m9OCp3RVyfEBsguFf3fvu7TgSgtLP6Esrq1WxIn3n0Pd3Mnkz%2B8HzgVwml3grp2f%2FlITZ8MqsTY2p0k5NF31cjWqCEuLdig%2BfcYcwE%2Fc7A0kZXk9UYaJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83c176e829c937d4-FRA
expires: Mon, 16 Dec 2024 12:11:09 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 7D40 12 KB
6 KB 132ms
20ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 9DE1 0
128 B 102ms
14ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=N8HE6bxWDoCsW9HOwJceGnmayBQKT0qeY1JOokZ_-gBv7q0nkMvzPUKdzY-UQqTo-F06LVm_E_E0XoCN1zwnVm01A0ykgtikfw4ECXDg4JyRxAGy6bIPdsLj75OLeb9g46E-r7fOsg2RsJpw7vKtbGtCFdL67LbB77LKmaEXWSaZfjAKBjW5WQhK-wb2aJHNxKTZjjVmK7WBvVKZyjYZc0J_4xN9GDtFei-NBpJmJz-CdcI7loh05RJaK4Yj-kIAdLq1ng&sds=2&rev=89983&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 9DE1 2 KB
1 KB 111ms
25ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 9DE1 2 KB
1 KB 14ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C059 42 B
64 B 80ms
46ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuzCowz1wZWu-e7XTWD9YP4voHe9QV7xykPOQOOt898nElf_qbNrUCLcE3aVf-yfJOhk6vZ51xU-vJk7k2CNeVhFcZPjI6HsnPUTz-jF6kgWfoWJYw3hC5sec_0eHOK-x1-hRIDrB0k-nOqNN10-tKgVyE2&sai=AMfl-YSvpy_dgDfukxI0oEEAl5vQrIQ5wkOFfQnUNc6OxSFmHBFFoZwii9Ru5_MqsBHc9ZIAKhC8hGtshL5MfJZtChI-uG_ZF2gpAtqFuzqK9vunVBcnfQwTcJ-Gz5Q0VjtpCSKE2ppj5f7Arp2HF7mc&sig=Cg0ArKJSzAfyZKoheS3KEAE&cid=CAQSTgAvHhf_8HRkxlhASkiBmb99EAK12BzFZQEDavSt5TnQ__EV0aU7scA8Gt_39g2yLyw_cunaUo-2Cj_vLFL48SzEfnNV3WIBaqsTyJrxhRgB&id=lidar2&mcvt=1048&p=0,0,90,728&mtos=1048,1048,1048,1048,1048&tos=1048,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3165135369&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703679067373&rpt=958&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 7D40 0
127 B 88ms
15ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=tcFMqbxWDoCsW9HOPA8nmt19EXaq35qvijX7WSa9WH5IwwnVK9_gR8tB9Js4tAY9_4fYa3Y8SouQMohj1Y2W3e6QXiIInHzw9sFJ52YCa9riixUN6y6azV0Zp0rMXzInkTZwWAkp-NmrA4Wu0a9cbFngr3-_NvrWDpn1SWLvZUd7tkS1FRaTFitpgS3MFdXFNp-iPBMvRJhIltVrQLsd9zuVOh-ilZCXlVHENhs6QkJguifEM5a1MaaEb8p-_WanufB4_A&sds=2&rev=89863&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 7D40 2 KB
1 KB 89ms
17ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 7D40 2 KB
1 KB 14ms
12ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
DATA 200
OK truncated
/ Frame 6883 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ca90e28c9cd25d9cc7e405edbc5a9d2da99f3a4d3c5b425dc70e7515c9e88171

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame E146
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

15ms
15ms

Document
text/html

2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:09 GMT
expires: Wed, 27 Dec 2023 12:11:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:09 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6883 0
0 48ms
47ms Fetch
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CEqG4WxSMZc2yGeqJ1fAP7p6tmAeT4ar5dNO1k6aYEs-Ph_mUMRABIJKygg5glaqzgsAHyAEFqAMBqgSUAk_QRw77F-cjaEI9XaOjeN8MNbworolyXCjEKPEZuTWFyDSq6mw_rC-4xTwz_ryEPETnIUYm74WmcIrgJJhB9bhLwpJd7EDm5xe_CXIkARmrTGlipuJmoFYP96XldWn9F9cwWORrdCMmUVlLtelmp8HX1RrpCYBWujzq5YfJyhLQlzyCQMZi7wYoB7L25I3A8D-QPIbuGyr8VS8VDuHscwtgKwiYZeII24RbUmxhjlIfnIMe2wOKxV0yfVcbtlwA102yf8bTY-zkf1a5BCnIdSbPaCUUs4wQTgPiWryZP2mq2NM2Y8HZHPYFrGWI9MLiP7_iK1Ye_6gIESNrLoq0sT2l5mYdTjUmngz_EAHXT0t0R9nVSsAEu4jbyL4E4AQDiAWtxa3HTJIFBAgDGAGSBQYIGxABGAGSBQsIIhACGAFIj5PHAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGToAHmpLo1QKoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHChCx0x0Yj56W_QHSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WNOh_4zLr4MDgAoByAsBogwUKhIKEOS0sQLutbECtbixAqy6sQKwE6DChRbIE7-kxOMD2BMKiBQE2BQB0BUBgBcBshccChoIABIUcHViLTE3ODQ3NDI0ODQyNjg0NjkYAOgXBQ&sigh=18gP6UNH4Os&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4CeKQXLA9bJVaZFlgIrMnDuXqopeYV2GSGBjnBgB&vt=10&cbvp=2&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
Attribution-Reporting-Eligible: event-source
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js Show response
pagead2.googlesyndication.com/bg/ Frame 1393 50 KB
19 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/gPTZx8Qg5YtqHYATuVEq7wiNXgGYJLmNtV6Q-nRIA0Y.js

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80f4d9c7c420e58b6a1d8013b9512aef088d5e019824b98db55e90fa74480346

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 09:01:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 97757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19632
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 25 Dec 2024 09:01:52 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame CB89 120 KB
41 KB 11ms
7ms Script
text/javascript 142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16661873397665731963/index.html?e=69&leftOffset=0&topOffset=0&c=bvb13SSQfz&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16661873397665731963/index.html?e=69&leftOffset=0&topOffset=0&c=bvb13SSQfz&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 12:23:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85660
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 27 Dec 2023 12:23:29 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B24A 640 B
262 B 52ms
50ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBjB4IKCAjAB&v=APEucNX0ANN6yhpn3ZfBXsOBpgRosk4JHSpMG4Fjc9dH1q1PVkhAy83Y8xOLifLkX5qUeZKTJNS5JKIrO_nxIa50kiVKn82fMlQ3fdZCN3ovhFy0yU0OekXe50h6pRR6AXFB_RuxqKsWngGCcWKyxgX_XmxlpHcIM9d_JI4-mxB_bs8x29zLStA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame F6AD 89 KB
31 KB 95ms
94ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H2 200 adition.js Show response
imagesrv.adition.com/js/ Frame F6AD 32 KB
8 KB 42ms
11ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adition.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 6356dca74d480f9fe67e7a08ad460f342880cfb3004f3ef6d8df6db39edae277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
last-modified: Wed, 22 Nov 2023 10:00:03 GMT
etag: "3305548861-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 8362

GET
H2 200 js Show response
ad4.adfarm1.adition.com/ Frame F6AD 3 KB
2 KB 50ms
13ms Script
application/x-javascript 217.79.188.46
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4.adfarm1.adition.com/js?wp_id=5158022&clickurl=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs-IChABIJKygg5glaqzgsAHoAH39-mEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk_Qgdz2uCTDlJO9apu4qa-G4TLTv-D9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6_xTF9iT3U5M0v5IaXABVnLzg_iYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv-TXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI-JZJIwSwNJDxs9SajHH24-PdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB_evuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY-MfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G-ihbQEwDYEw2IFALYFAHQFQH4FgGAFwE&ae=1&num=1&cid=CAQSOwAvHhf_-UC5edhqfpTtDBXNWFZCwLwrlvGuo3o98_wcgxU_jtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE&sig=AOD64_2jlVGqxbLIGWVAvCqWlrvIQwR4GQ&client=ca-pub-1784742484268469&dbm_c=AKAmf-ASTp4OqI6Pgt9_TyWTlISKbGk35-bI7w12joiQ4sCKTI7_cTZFhfq23P3otNXQ-8qTascNhA-4zTgI6DV4m57okvYadFUsZ3wem2XWf_xBQAZ9Gmw51VCPYQLxml9xB-scR8gr1yMYpcGtBFfGOjgBRW0_CoMp6JETaChgPSjv1raI0xk&cry=1&dbm_d=AKAmf-BOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs_HRVlKL5Ik_zcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl_u4Ikvqin0-6gXuQl1WSKrDUiSUZMid2OGT-aqL8Ock3cHGAOI9U0oy-5IY0XrCFHP4mbjVGffCKU5HuYLr_de2T32XGGhRUtFHmMV3-SaYNAmFQNNWA5KuyH6TI1IRycpKhCySf-5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57_wVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ_dNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4-hCL0RZfeFqSX_DYp4Hg-SvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg&adurl=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.46 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad4.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: d0e6bc7fddce828fc352c33f0b095df6f518a2519e7cfe6c7238ea2e7307ac00

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Wed, 27 Dec 2023 13:11:09 +0100
cache-control: max-age=600
content-encoding: gzip
content-type: application/x-javascript
server: ADITIONSERVER v1.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame F6AD 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame F6AD 20 KB
8 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52880
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F6AD 0
0 16ms
15ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS89aeW4AdBP3DalTPBj6KHM-Otv7pjO-DO7wMfIBCU7kkEzSP_FMYOAoOZoJqvl_nWBNQ7T1eT0FhlMcDrdvIktkgzCg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame F6AD 203 KB
64 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F6AD 42 B
63 B 44ms
43ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AdWwqZS3xFiTEjFZAgCBbBDgKUgE0b-ikTKW9wja6FRtv-Izc2mEaeYEqMbmjNaXxTV8wRe2PgIjGRPnvAb9WlTVfdZbOsaCno_OYmMxj13wBgySk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
54 B 578ms
273ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lqnqj34s&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&vast_v=2.0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
vast.doubleverify.com/v3/ Frame 6883 21 KB
4 KB 123ms
67ms XHR
text/xml 104.18.36.54
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://vast.doubleverify.com/v3/vast?_media=3&ctx=10242044&cmp=30443038&sid=5513185&plc=380567266&adsrv=166&_redirect=1&psf=0&_vast=https://ad.doubleclick.net/ddm/pfadx/N7657.3553448DISPLAYVIDEO360/B30443038.380567266%3Bsz%3D0x0%3Bord%3D%5Btimestamp%5D%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext/xml%3Bdc_sdkv%3Dh.0.0.0%3Bdc_osd%3D2%3Bdc_frm%3D2%3Bdc_sdr%3D1%3Bdc_ref%3Dhttps://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html%3Bnel%3D0%3Fves%3DdGltZXN0YW1wOiAxNzAzNjc5MDY5NDkzCmNsaWNrX3Rocm91Z2hfdXJsOiAiaHR0cHM6Ly9hZGNsaWNrLmcuZG91YmxlY2xpY2submV0L3Bjcy9jbGljaz94YWk9QUtBT2pzdXNTMWJYWXh0dTl1ZUREdWVDcHprMlZnU0xPNkczYm1wbzFJdkozME44b3BHX3ZsaGlCUkZvSWtFdTl5ZFlQM0Zqb09IQW91T1ZTS2R5QzBwODIwbElaRmNfRFZUZGw2aURrcUI2a09CVjZMNVpORG14ZFllc1V3Y3kxVHRhR2tZQVNrZFEtXzVWUFRnTlRmYm5uTkRpTDZvSnk0T0s4UWNrQThZN1FVLWh1UmVOczZua3FzNG9sRmNFRDNxSVFMTjdLSFN5MFhuNVB3aTFfZXpqQmRCYURMQ2FuejFZZlY1bHdfQ01sNEtaNXhCUTMzb1JfYmJrVEVRWHRyZi1BZ3NTN2I5NHRLTy02WXRyRWUwWDk5d3NuamRrNkhIZTgzWHllVHZDanowRGtuTlRrZzdibGlacVpUbzhhUXhGY3hWTWVYdHN4Y2lHdDZFbVJLaFZ6ZHRTM0d5Qk5GOUgtZWEyaU1NODAyVWpvTXdCbFNxODd6SWJIdWxLYmZqX09OdnVyeHBpbjhoZ0p2ZHB6LTlsblpjTG1OU2prSkI0OXZaNWhWUzYwdEdkbGlJM3A3cHp5QXU2eEJReExEWEVzcENUMy1vU0VFTFVyWDMwSmxSNkdmUmdBSXoycjltOTRvSFdpZnVuUnhZcTdmUFJ5RXo3X0R0anEtQ1VVNG1aZUhXVzVsX1V2ME9TdTdXWVJGem8zMU5aNmpFMDdBLVlhSl9JWjJKV3JEQkcwVGkya0hWYWw5UmpDZ0tGajVQV3BmQTNzVkhXSUFzLU5tRlczOG9FbURvVmNYUExtdnNWa3RQdTNPU1RxR2tCSHlBRy0weVpQNm5PRTJab3FvQjFkSm52NmQxVTJNMU5fc1M3MzVQNjVqOC10Wm9LWjVTbkgzNXdCc1cwNzhEOGVmSEc5LTZyUnFYeEMxTlpZTGFSVGxnR1VwWENQOW5DTnlxNGVpdW1mNFlxRWNBMEpSWVZzM0V0dVdrUXBRbHotZnJMclZfRFVmN05vdE02R2ROZmJVMWphd3FOdm95R19acE1XMW9vWnFLejNRYVN5S0RRYmJlVXlNbkZYVUNvT2dUd1dKVVp4TmNDcmxMNllMVFpMbk5IRVFuXzZYejNwOFZFeFI0YUM1alM4RktSdDdQX1RRbU5mdWxBa3FZWmpNMm9xZC1Wcmh3Mm1fWTRzMmsyMUs3cnpvNU41VXZXd1lhUmotRTBnR3VBSHNlM2xpRDh4eVhnaUdCV0dKeFJEWXF6a1A0TmhhQUZHZk1KWDJ0Wll1ZjlmR1Z2b1NYRWtCVXVlaW9ZaW8tbldqeF9tSnlBQl9CS1p6YS15SHJFZ29YNlFEcHJTbFhKNXBLVllvWUZ1Z2VJNnQzVncyMUVFMzU5dXBnMy1LTkF0M19STjJWWUhEdGVseURSM2FfOTZjWXp2Vm9JLTdZM3l3d1VONnF1Q1ZpcWlseVlRdlAxSlFrM2JrVlBDWVJsZVBzbWh4NzEzRGMzY09tTTBHMTVKZ1p3LTktUjJLZUYxZkVZbTdsLXpMS1pYVS1SZ3lLM3JnOUpLM1FSMm1VWHBMVzNkcnBadWVkNHBLRVl1TmY5RTZTQkszbHVJNGpDQXh1ZFBmSDBzNVRnLWZjVXJ0cXkwYzdfcXAyS1E0VW1hSklUS0duZFUzNmszcmVidjJFOFZ1Z1Y0dUItRlRpaUZnWXVQblF1WUFsbk12cHZGdDN1WGlHQTFPY242Nk5TSFQxblZuY1RKek5ZLW16LUhNZDhQbWdiQ2ZWYkhZQW1zNXl3OHRZUjF6RTRZeU5jTnNVbGpfbm9WRWN1eVV0NHRNSSZzYWk9QU1mbC1ZU2ZoNFBzZVFaclZuZUhBYld4MC0yMTBDVEdhVjhzZDhGR2dXMTdlcUpPZmdtUldpWTN3TS1uejBkTURSUTkzQ2tVZEtBUUlxMHdZQ1VFX1JnTDJrY1BYWkNxaHdtaGhBMGFKS09NWDZ1Q19XRzJLaDBMZnJEMnlVcjhaMVlBOGdpb21XMjdRY0dIYldXWWhzZlZscXFKQkZXNXFkX2N3dkZSdUg0Yk9QS1VjTHQ5ZG5PSWh3WWkzUGgtaERxZ3p2ZE5yZzI5dGJmM0xyWE5mZExLcFJrblJmM3Vmc0d5NTlYMTFBV280dmdyOWxDTUVmWXRWQ2k3UmNvanZ1X2tlS0trVUY2V0JLdlFqMjF1SkRKUHlZaUZ2WEp2dGpVTTFHdHYtRWdiLURCbzhTXzZWa2Mmc2lnPUNnMEFyS0pTeklNRDdLVl9jZTNZRUFFJmNyeT0xJmZic19hZWlkPSU1Qmd3X2Zic2FlaWQlNUQmdXJsZml4PTEmYWR1cmw9aHR0cHM6Ly93d3cuZWEuY29tL2dhbWVzL2VhLXNwb3J0cy1mYy9mYy0yNC9mZWF0dXJlcyUzRnV0bV9jYW1wYWlnbiUzREZDX2JyZF93d19tNl9wcmdtdl9kdjM2MF9tZiUyNnV0bV9zb3VyY2UlM0RkdjM2MCUyNnV0bV9tZWRpdW0lM0R2aWRlbyUyNmNpZCUzRDczNTk4JTI2dHMlM0QxNjUyODkwMTQxNTkzJTI2ZGNsaWQlM0QlMjVlZGNsaWQhIgo%26dc_cid%3D206729091%26dc_adid%3D572283934&_api=[APIFRAMEWORKS]&_ssm=[SERVERSIDE]&_tsm=[TIMESTAMP]&gdpr=&gdpr_consent=&_abm=[APPBUNDLE]&_pum=[PAGEURL]
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.36.54 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f91beee5d305ac96dcf0f05448af9b339de0712bf7123f463900b9d7b78bc0b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
server: cloudflare
vary: origin, Accept-Encoding
content-type: text/xml; charset=utf-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 83c176e90d833a85-FRA
link: <https://cdn.doubleverify.com>; rel=preconnect, <https://tpsc-video-eu.doubleverify.com>; rel=preconnect, <https://vtrk.doubleverify.com>; rel=preconnect
alt-svc: h3=":443"; ma=86400

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame DCDE 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&adk=3809598800&adf=1839787983&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1958&idt=-M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0&nras=2&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3353&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=1&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52879
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:50 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/ Frame DCDE 20 KB
8 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231207/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d6679c1ce1ac8605f5c410f30d1b06713479732043b75e81130cbe21b60e579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 21:29:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52880
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8571
x-xss-protection: 0
server: cafe
etag: 5853369240893788875
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 21:29:49 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DCDE 0
0 16ms
15ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQSdp1f7MpVySsmCHiKexf1eTDQKijoNHemk2KYlWHbQKhpMFbm0hdR3DQ4yNPAd4CSt4nU3C66xJ8MSrlYKhq7mI_f-g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&adk=3809598800&adf=1839787983&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1958&idt=-M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0&nras=2&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3353&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=1&fsb=1&dtd=4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame DCDE 203 KB
64 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

566012676f5d43acfea4dc0bc5d9bb2c0805d8775fcdd081b1c895310956829a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65731
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1702472459035717"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Dec 2023 12:11:09 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 2C06 176 KB
53 KB 83ms
83ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZYwUXQAApS0A-RWtAAF2oUxGaJmITHjxcUWj9A&u=%7Cho9F3x8XBfp4va0t9VmGXagoRLX21UbHqJL6j4RrxD8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC866nFjl4YrFP14DeBL3lPpEnFxTCHNntV3tTRJG5kiqHsNhuTRsSA9A5Eeu0uX3uB2K1Pa1dXNeig1OuF8LVfPCXw4x40C5Jg0OaAUx6HtvyMwL4lfeliXj65fKn3f72Y4X15t06LOXSmB5QccEmvtkRWpbOgIlfN89m7vLtQ95UmgXb1ImcC1q4pzko13Gz1JzB8q51xjYsVaNcB0d_iKoIGGqE8R-1TpZqQN6usl76VHLOYDHw_1nh4f1tM7EZhvE7fsXbzkxjjL6-s2VTEXisbPcBhrB_b2AX8KbqQtUmXK18OBHyU9oCf0YSYoAqNZM0pFW9arCn3Isdyt-rTdBjAKO-jwaOrneMGlncDNLcgIUyPhqSJX2QkJW44vyj9SINdzXR2uxWhxxj3l75NszGOs4DqUThQz1xRQUbeGCANo4uBuw2lr3Kpq-jv3d4gjpeBtqR3dnpvmQS4sARK3-XPeWxBPqjyO-TPE1YOu8G54Aq9VqNJP9Yz6jtBDEbqL4htb0C2aboq6OzhYEXUoYfY_py0zUCOd5Qg6mQwyAvsZ4pLJ-lFoRd8YBuxiFYujg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmYP-XRSMZa3KAq2r5LcPoe2FoA7JntKxXM2jlvdwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgT4AU_QZx_OVkWm3g_thgcX1Tr24SZF5fHXfdSkcvfjrLk_87AEeoEmAzcwhfilXkG3Kz5OTRSV9vNgBxPcF2OiLkTb5a_us6kv6i0szrp3NmMiZeOJ4rLNc9UrBsiWQ6wyBvVccF7YgZhxia4Qbuh0XM3xrdLKcQv2w_zGbcDV_s6yGPaxwW7Fuizv_PNB9NUMDgghAF9FuGbdcgBz1Yd7mMVIhL72s-7yO-hbgQgsahfhaHbhKG5o23Dx1OHsXdXXOlXT2mfHOoMlPKT-BJeV3jl9IhsE972DLWgI-bt6CNAo2mrDOwh9ulE8J0_uu16alET7Gdx3PCsMgAb1p52QmJX-uHCgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpYzbvejcuvgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2T00DLE69CP76weXHcvCm48hpTDA%26client%3Dca-pub-1784742484268469%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

edbe1e80094d417dd392874efdb4e734cdb7ba5360a7b9c11284e32c14a92531

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:09 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=uUARVbxWDoCsW9HOMk8XYglvaynNKoRuPAEtCs70hyhVpRQKX-8KXxlui9m2SGhiOut35lJ4Ia9NgZqzIO-6EfBRTlt2gl8KjoA20tb0H7_uvY0r1vlQNRxdWGcf2CGkf3__SLsvHhaaH5PLZpsGA0zXiWpH07ejr0YIKTlTdVxAY5HUfYN0eR60KT1V43kUF9mSm6y8Wg9Lv57SQI-6Lo1esjqVJlVZmICXIX554EmwNyTkikYuUxDXvMN8K5jGB7jyog"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 64217515
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 88C6 1 KB
647 B 10ms
10ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 55875
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Wed, 27 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 18E1 39 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 10:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179747
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Dec 2024 10:15:22 GMT

GET
H2 200 ec51d215a5904df99ebfe8eacf21246e_ubuntu-light.woff
static.criteo.net/design/dt/ Frame 7D40 46 KB
46 KB 84ms
58ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/ec51d215a5904df99ebfe8eacf21246e_ubuntu-light.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8d6af87f2e8ab6ba751d5bda81faf18aed637f3c43f3f5c25acfcdb8dc674a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 02 Oct 2018 14:57:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5bb38755-b778"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 ec51d215a5904df99ebfe8eacf21246e_ubuntu-light.woff
static.criteo.net/design/dt/ Frame 9DE1 46 KB
46 KB 51ms
26ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/ec51d215a5904df99ebfe8eacf21246e_ubuntu-light.woff

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8d6af87f2e8ab6ba751d5bda81faf18aed637f3c43f3f5c25acfcdb8dc674a92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 02 Oct 2018 14:57:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5bb38755-b778"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame E7E6 0
0 63ms
60ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstbznE0oNb7EIsGtIo-F7akrYUC2MNsIIhJwBCEX4IyBxZP2ISk9DOcgOGr4d7-olvIWCcJDWQdjapAXrfIQRWKpynQhou5mPQOfw5GTwrp-0ov8IcZgIw33hun7M2Z7yaqlGvLhFxnvtGMpcdgwdAhPxW8eH-g2kZ2p826scVYYLq4IsSW-wJlFcAO2fw5FgMvYTivl2zoZUnYb9nNgzMaIFhJsr68_TecGRD-g5SCDbeO-Pxtol-bDLYEws57ma70DjtPjxIeXLwuouHhwMtw23TChjE3iFyKwsqNqmseFDf8QurXHWlAJqGtQ33kY276Pn53g7GQzp-1FLIn5uzX5FcQkzIB40FAMrc4aF6lf3fEIRc6Bq20SS0Iu08fFrcmYAw9rbFIB7QFdbfeIhsX_-sHfQq4RbTkGr99gPuKeJazyLRpmSgstlfXh5P1oeL-7aoZ25RWXCLosZD-4V1ZcsetWBH57v057VjhVgE_PJdyArnlYNXmJXBwOVcficwp63O6Dox6EghDVxcFOraB5xzF8Yhlqu8iCYcdWPSuG-RGcE5j1eK6M-yMpanMyrr5jY7FOupUGAimUjD2a4da8wl8DRKi9ApydphizoEAvlAAFHYwXuDe8cpRhzeQbpv7uC-EOhWmtez_wBjB812C2Adki3afkmzzMENjD1Kl20yh0yd8xqxOzHoXkN3t4AwAOHzQWgNnCyy3rEtgbpf7P8QAdlB5wXuGXkCX7nR-OdpIuIf266j9-_X4gc-TpCeRWDXQcvNDNc3PTAUslvm8u9H7FMKfR0hbNsObfVqSP4E8jBFHz_dzlQjq2eCYFVFkvnXptoWTJYiQtE2Y-noj0pjnCrXUWF49eEnA2tZOZjRnkVgYxBmv6tmWAm7D2E2qQLempM_GT8dImRpuv_rkQqyo5bqSHM_QiMPYhZj4rWSvNCPNoy8hj1N599c9Z3qY53NyhZ_ol8Q2GwY067MdpL5KclGq-vRSwECBR_X8NgpDKOUpVULmTRClc-QyGJnjWaBgaUYOHvzIT0u5L-E13WqVAFcAo1PyiV_8ehAR2jnjCeCdZCN_HTWBCvMKY_JeFy-q9QlTMjpTGg5DZzmSt1NCh9lOl8Sr9KN30vZ_AGK0za3y4PCB94ZmTsC_ZJ1lNyrUQ1mfguCLmSemmsQSWtUiMOO_rT_0aUHMJ9BR-aRua-WIXKxrmWhODTHfMsNyENnYwjP1Ks53aw9ySZUKOHbIhoC2FBZ7LcYNg1KKucnjX9H0AGtETM4wkfLD3k6hONQgMAmO1rIR64V1e7v4YUk6kcWjiZApPBxOFY7XNVTZa4x6VUIaRxVXufM6npq5KoKbrLcqDm4BvvSD9V-s2NC4k-FrBQfy6AHYsESb&sai=AMfl-YRUAjJ5CPpRbblRsmbB-xArNNhKJx6ypQMslr4hFnCwuSLwz_qlwXGc7KIVJAh_tkTQDf4_tcvH5zCN7ohaShfM3j8ZPj99VDjVG1-QFbNfJnyjI71KKLr4qJLCySrG1L8X2Hzt_gcVFqFyktP6hpeaOcsoDLUaQDuaOJJxgqtlvZcIfhZTmMR0Gp7GYmGIk8-99SPLRVEfYHM3_gbabDfB99XRvoelfXikRGpk9VS8uPXcebTYhfXgCbTBThbBE0Z9zYsW64XaLJ36JbpdhLP80f7Q8xzgV0eKfg&sig=Cg0ArKJSzBgQvyFkb-EEEAE&uach_m=%5BUACH%5D&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=454&vt=11&dtpt=322&dett=3&cstd=122&cisv=r20231207.80544&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame B24A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG4Z35mSTR_DlJGX5MOcY7k&google_cver=1

43 B
105 B

44ms
35ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG4Z35mSTR_DlJGX5MOcY7k&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBjB4IKCAjAB&v=APEucNX0ANN6yhpn3ZfBXsOBpgRosk4JHSpMG4Fjc9dH1q1PVkhAy83Y8xOLifLkX5qUeZKTJNS5JKIrO_nxIa50kiVKn82fMlQ3fdZCN3ovhFy0yU0OekXe50h6pRR6AXFB_RuxqKsWngGCcWKyxgX_XmxlpHcIM9d_JI4-mxB_bs8x29zLStA
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEG4Z35mSTR_DlJGX5MOcY7k&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame B24A 43 B
295 B 63ms
35ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBjB4IKCAjAB&v=APEucNX0ANN6yhpn3ZfBXsOBpgRosk4JHSpMG4Fjc9dH1q1PVkhAy83Y8xOLifLkX5qUeZKTJNS5JKIrO_nxIa50kiVKn82fMlQ3fdZCN3ovhFy0yU0OekXe50h6pRR6AXFB_RuxqKsWngGCcWKyxgX_XmxlpHcIM9d_JI4-mxB_bs8x29zLStA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame B24A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEF4YtWYPc4CDkqXUpr-hZ2U&google_cver=1

23 B
163 B

74ms
46ms

Image
image/gif

23.211.8.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEF4YtWYPc4CDkqXUpr-hZ2U&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBjB4IKCAjAB&v=APEucNX0ANN6yhpn3ZfBXsOBpgRosk4JHSpMG4Fjc9dH1q1PVkhAy83Y8xOLifLkX5qUeZKTJNS5JKIrO_nxIa50kiVKn82fMlQ3fdZCN3ovhFy0yU0OekXe50h6pRR6AXFB_RuxqKsWngGCcWKyxgX_XmxlpHcIM9d_JI4-mxB_bs8x29zLStA
Protocol: H2
Server: 23.211.8.12 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-8-12.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 27 Dec 2023 12:11:09 GMT
pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEF4YtWYPc4CDkqXUpr-hZ2U&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame B24A 23 B
163 B 116ms
50ms Image
image/gif 23.211.8.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLDuBhDpgb2LBBjB4IKCAjAB&v=APEucNX0ANN6yhpn3ZfBXsOBpgRosk4JHSpMG4Fjc9dH1q1PVkhAy83Y8xOLifLkX5qUeZKTJNS5JKIrO_nxIa50kiVKn82fMlQ3fdZCN3ovhFy0yU0OekXe50h6pRR6AXFB_RuxqKsWngGCcWKyxgX_XmxlpHcIM9d_JI4-mxB_bs8x29zLStA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.211.8.12 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-8-12.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 27 Dec 2023 12:11:09 GMT
pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
DATA 200
OK truncated
/ Frame DCDE 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a8e112e8f1e7707035685738234c2e4006c7fad4605fc6acd1be01bc473d4b00

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 88C6 35 B
464 B 37ms
10ms Image
image/gif 2620:116:800d:21:e365:4988:e8a7:3270
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELBCGBq8-9GFWGVx7ZqSyFI&google_cver=1&google_push=AXcoOmQJ3om3CbD-ZmrwV-r9FMei2HNHDjKJFEE5TP1l4wTgpP_1VnoqaM9p21ihRYSnmw9XeAg5PpXYedodNwmT9JOx1XX7nLFGL7qp6PUPRZouc3VmOxQ6BqECmVk3DduFZ4YGxkS3U-wVPe166WGgcLInY3Y

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 88C6 0
104 B 76ms
23ms Image
text/plain 2a02:fa8:8806:13::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEArLZ1xH6rjAnJ6Il89rj9s&google_cver=1&google_push=AXcoOmQ1qbZQJ7fyTTRI0bhqmRpvvIl2rd836F_6nkTqAldX28pts0gQwV2zfNW5i5dV6pZTiBKGrekhgzaXIESkM-b5Lkp0J3a_y-aqOonGLVQwrawJlax61HubG6QCsyCSpJuMVO3dfBccynViRdVDSmeewdQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&adk=3809598800&adf=1839787983&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1958&idt=-M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0&nras=2&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3353&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=1&fsb=1&dtd=4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 88C6
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEB5Mbzot2OBrSGkkR4fI1Wc&google_cver=1&google_push=AXcoOmTVV7PcMhAaJJRwEgxZUbS0IfHp0ft1QFLqZMVVw_o95a3a2t7OAFehHJwF306ONCsxgP4esCVu8AZ-fnzBZPYeErIFEYGWY...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEB5Mbzot2OBrSGkkR4fI1Wc&google_cver=1&google_push=AXcoOmTVV7PcMhAaJJRwEgxZUbS0IfHp0ft1QFLqZMVVw_o95a3a2t7OAFehHJwF306ONCsxgP4esCVu8AZ-fnzBZPYeErIFEYG...

43 B
441 B

167ms
166ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEB5Mbzot2OBrSGkkR4fI1Wc&google_cver=1&google_push=AXcoOmTVV7PcMhAaJJRwEgxZUbS0IfHp0ft1QFLqZMVVw_o95a3a2t7OAFehHJwF306ONCsxgP4esCVu8AZ-fnzBZPYeErIFEYGWY7QRE_xRJIaS4Rn3IjNa4JKtn33p4zBIw3x0McqG7ldpvN8qJu_eWNZT82M&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTVV7PcMhAaJJRwEgxZUbS0IfHp0ft1QFLqZMVVw_o95a3a2t7OAFehHJwF306ONCsxgP4esCVu8AZ-fnzBZPYeErIFEYGWY7QRE_xRJIaS4Rn3IjNa4JKtn33p4zBIw3x0McqG7ldpvN8qJu_eWNZT82M%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&adk=3809598800&adf=1839787983&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1958&idt=-M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0&nras=2&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3353&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=1&fsb=1&dtd=4
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83c176ea9c2a3683-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 593
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEB5Mbzot2OBrSGkkR4fI1Wc&google_cver=1&google_push=AXcoOmTVV7PcMhAaJJRwEgxZUbS0IfHp0ft1QFLqZMVVw_o95a3a2t7OAFehHJwF306ONCsxgP4esCVu8AZ-fnzBZPYeErIFEYGWY7QRE_xRJIaS4Rn3IjNa4JKtn33p4zBIw3x0McqG7ldpvN8qJu_eWNZT82M&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTVV7PcMhAaJJRwEgxZUbS0IfHp0ft1QFLqZMVVw_o95a3a2t7OAFehHJwF306ONCsxgP4esCVu8AZ-fnzBZPYeErIFEYGWY7QRE_xRJIaS4Rn3IjNa4JKtn33p4zBIw3x0McqG7ldpvN8qJu_eWNZT82M%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 83c176e97ae43683-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88C6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEELzkebz1G4aju3d4dojv_I&google_push=AXcoOmRn6YDTqUG_oZmHsEMmTSJHvK1ap0K4e2_zyYjfCnDdiCBejmeROe...

170 B
188 B

21ms
20ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEELzkebz1G4aju3d4dojv_I&google_push=AXcoOmRn6YDTqUG_oZmHsEMmTSJHvK1ap0K4e2_zyYjfCnDdiCBejmeROeDPmJDId-q4c4ttJXPr6X_Wvoq6bhw5YoGGilM5YQ8XOV8BS9kfBnDbRbJUR8afonbCIkXgUnNPTFrciFFxEbweWyj_C6oCktOPwAI

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-etou8220093-FRA
pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1703679070.673317,VS0,VE89
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEELzkebz1G4aju3d4dojv_I&google_push=AXcoOmRn6YDTqUG_oZmHsEMmTSJHvK1ap0K4e2_zyYjfCnDdiCBejmeROeDPmJDId-q4c4ttJXPr6X_Wvoq6bhw5YoGGilM5YQ8XOV8BS9kfBnDbRbJUR8afonbCIkXgUnNPTFrciFFxEbweWyj_C6oCktOPwAI
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88C6
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBUuqW2FwxRuwsctA8axMmw&google_cver=1&google_push=AXcoOmSGH-WiVPS2IKjYIatGz21HTf1Lwl6BetTqvksr-Dw0pWu7GqOFoeb43ITnGup1ztSHeaAzXrWSwgHABBWE...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0R1JGZ--RxgvEUahyjeJfA&google_push=AXcoOmSGH-WiVPS2IKjYIatGz21HTf1Lwl6BetTqvksr-Dw0pWu7GqOFoeb43ITnGup1ztSHeaAzXrWSwgHABBWEXPiQ7rbCeVG84w_...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0R1JGZ--RxgvEUahyjeJfA&google_push=AXcoOmSGH-WiVPS2IKjYIatGz21HTf1Lwl6BetTqvksr-Dw0pWu7GqOFoeb43ITnGup1ztSHeaAzXrWSwgHABBWEXPiQ7rbCeVG84w_Y3lqWo-v-Szo_NV7O3Xj64hZJGqLlCkoAujQKRpMAqvXZflqsqHEI9T0

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Dec 2023 12:11:09 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0R1JGZ--RxgvEUahyjeJfA&google_push=AXcoOmSGH-WiVPS2IKjYIatGz21HTf1Lwl6BetTqvksr-Dw0pWu7GqOFoeb43ITnGup1ztSHeaAzXrWSwgHABBWEXPiQ7rbCeVG84w_Y3lqWo-v-Szo_NV7O3Xj64hZJGqLlCkoAujQKRpMAqvXZflqsqHEI9T0
x-host: tde-deliveryengine-production-59dc4ccdb-fgs89
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 88C6
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEE-AolRDshITCb4ZU92BliQ&google_cver=1&google_push=AXcoOmQW612cL1bqgVm4inpxoKUbwX7-BWayj-twDGTc7E34--N29GpRy8T5D6GhhJ_zhW782lzDwTZAewFL2EF9dwYM40c...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQW612cL1bqgVm4inpxoKUbwX7-BWayj-twDGTc7E34--N29GpRy8T5D6GhhJ_zhW782lzDwTZAewFL2EF9dwYM40cGHdnAsubXORNxcODdoI72QEtWf3aM968Be0uZe...

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQW612cL1bqgVm4inpxoKUbwX7-BWayj-twDGTc7E34--N29GpRy8T5D6GhhJ_zhW782lzDwTZAewFL2EF9dwYM40cGHdnAsubXORNxcODdoI72QEtWf3aM968Be0uZeyK1n-FpCIocKePYTdAkqYO_Lac&google_hm=eS02dmt0ckpKRTJwR2JZN3RBU08zTUhWczdmWnNuZk41en5B

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQW612cL1bqgVm4inpxoKUbwX7-BWayj-twDGTc7E34--N29GpRy8T5D6GhhJ_zhW782lzDwTZAewFL2EF9dwYM40cGHdnAsubXORNxcODdoI72QEtWf3aM968Be0uZeyK1n-FpCIocKePYTdAkqYO_Lac&google_hm=eS02dmt0ckpKRTJwR2JZN3RBU08zTUhWczdmWnNuZk41en5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 88C6 43 B
363 B 64ms
14ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmTDMFRTlw9u92MShV8MNT3DY8ICIqzzGmGTCGJfw3EG7zLnFDRSHLvVuR5TfrBFh04gdTnPgnSKBukQ4ey-OZA6v8KXZK90uIyeTsiC3bOVFSw9jOvQZXZB_v-n2FTZDWbZ3MQgkILx7krQRUngFfq9t40&google_gid=CAESEKKhvScRYjPmOrHukbvLHdw&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:08 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 205446
expires: Wed, 27 Dec 2023 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 88C6 0
12 B 20ms
19ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kw2OqBKy8rPcrqY5P-FVQzMwptz89UYivuteVcnyX3XBnzsPcV1S1Hcsey5cL-c4hfasLg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DCDE 0
19 B 52ms
52ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CydZNXRSMZa3KAq2r5LcPoe2FoA7JntKxXM2jlvdwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgT1AU_QZx_OVkWm3g_thgcX1Tr24SZF5fHXfdSkcvfjrLk_87AEeoEmAzcwhfilXkG3Kz5OTRSV9vNgBxPcF2OiLkTb5a_us6kv6i0szrp3NmMiZeOJ4rLNc9UrBsiWQ6wyBvVccF7YgZhxia4Qbuh0XM3xrdLKcQv2w_zGbcDV_s6yGPaxwW7Fuizv_PNB9NUMDgghAF9FuGbdcgBz1Yd7mMVIhL72s-7yO-hbgQgsahfhaHbhKG5o23Dx1OHsXdXXOlXT2mfHOoMlPKT-BJeV3nt_A4mEZG2-i7gvIzda4XQm_WB1MSZlOOX0GukcBEC2jNwxjfyegAb1p52QmJX-uHCgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpYzbvejcuvgwOACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMTc4NDc0MjQ4NDI2ODQ2ORgA&sigh=DfZLjon7tl0&uach_m=%5BUACH%5D&cid=CAQSOwAvHhf_B8IkHeBfEL5sCTjUADoDAC8NvOZA9_YgdHIywFPTTeD03vuV6balalTHWIWcmIDvnP-rl0ulGAE&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=280&adk=3809598800&adf=1839787983&pi=t.aa~a.372871807~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x280&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1958&idt=-M&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0&nras=2&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3353&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=1&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame DCDE 0
125 B 130ms
13ms Image
text/plain 2a02:2638:3::9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kI7EGMz6RLAJmAKdg2ICAgAAADLTrpMBxaBVEFwUjGVpi7yZOLcqUnWSAAASAAAKCkFRVURBUUVCQVE&wp=ZYwUXQAApS0A-RWtAAF2oUxGaJmITHjxcUWj9A&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 131075
server: Kestrel
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F6AD 0
20 B 42ms
41ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5464700053165&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F6AD 0
20 B 42ms
41ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5464700053165&version=m202309260101&ct=77&x=1&cor=12719247477613752000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F6AD 34 KB
19 KB 183ms
182ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BicO8vXaWSH9nebinLksdi_dYMx0zneJ6qDg3xwnAoJ0RDb0vs4uarAV01FyKvqispkKSgqIM-kTb2UasFPk_PAw126UrgDX8WrL1NYYnalPeIITT78j2YCYRFoipnuzjsUraeaMW1s-bafuWS1hA1p9Hi12bDLcsgKYWgqCOsa5m1EX8&cry=1&dbm_d=AKAmf-AhXe8G36JvWAPf0Nu2WYGDbADEW2_Tlg7qHsY34gRe6CLa3LUiCYuJFaAT1-11isyV42aXOY59kQ4azSjxKt4Asa-eoClcznjfcFAIyFgQX_5ZNiNAb2V3peUE9S3k-zjmtslaxDG0TYrBE66YVYZG8SBy2qcMhuIoL87J9Tm_oPaw3URzFFyprvuV-CYVdJPYGRyDyxx7zahY5HshaEz3Q-2_EBTZFT7zR7QfxAPT1ijhNQ3hArJF-sk_dSDJ1zfEBJv5LIlg8Dwlrh_yDPkmORKX2ivUXkocVD7jX-vQLSmtxJ7NYR-6riSfGSgUL0QeNkKRc6SzMLWmKzKcMJz5EQ8hzZ4PqdQ8hoVzpiuQvcmOXK5WtgXMPsLE07xrVNv74n5VxzCqZ61EUQa2gQBftII_T7aW-YhQnGPgr_a6_9xPSVlPYUXM7Wg9ATnoKq2MmVUhI79xqNVm64WNS8Hpd5W3fg-E1Y0Lc6v_xAz7m5A3zwVRpxI75JwoittxqvIcwolseu8PJx9dczRxwZtTUjFGiJy0Ud5g8A64csOqgteBk83VxgQ5YKiiES-Jm1bLS2HLP5BcQ6wt86un0FxQODcojgpCiGx1hdrX1K-wjulY3LDadepVhsMEJjn_uiurqBj54Erz0yoy7FkOe6irKAhTGX7c_UEknxQ5APGZ9NzNKw6ioZPSyU_CMtTwuGFSL5UX7mnQDk0U6HwN4EICuZJND0kxT1vRyWpb5gc6rgwQkc9zUXdixIQ38CMf3wcTyj2QyYAkofcFrSFA0AnA8d7GoS3RX3jCZU8umaxJAq-CEMvtQSAlXU4WCaZWkrQQ-kjgo958b5Vg2oYB3PZbGC7WLG5r3AqKjiUlP5E_WgJApg34tJ41TVlTCZ1MxWCeCvGpwf-mZSJVnl0mnYpV8k9E3_sLERPJCa7BzZlgdgsOen6kD3Vy9QXnYKob-5lCOuDHgPztDNQg5lJSOaDm2abK9BRuQmlkepPmZE0F5est6b6L59fw2jOnbW_n5E4fxzZx3M50x8tCCd05agVkUsxr2BreSxThQMCQqS5IVGKXOy6eVlIJqcGMRwIWOYMi0WNna993LvTqzJe32rvvbJwigKxqaq4Yjq5nqykmedkLQG2Mv6nuVH8_WHsMv3oZjyUBslGFPtlvFzdNxTM5McA7TnoPn41CKU65IYYLGxeH6XOEDG2IGCQsuTPucREsWggh7ux4YREb6kPeLJDOvULGRyyf0vizW5G7mt4xIeF6P3-cGzF0MNr8fyisgzoIXvClrYlrk8NXyMLTYArnnGAN5LfwqofS5HF0DIjIfEtxlIGptJEXcHRNqcrpBeRQ8HskkFW8O1mvnrUrzOuLJ-DVd7SeDeDA5GiZtpbgnG_ny97xwgibR--oNFDcypcQhguHYslLDxIFcV682I1Bx5KJvwFbY8M7YrvjMNgQ1sVcSGbnMFub4YwvjnYe4CVMw0y3eAwI4GCdfheD-1KArZ2Xmz-islyR6UB_wR55-clVAQgjGw5uW1fJI88xRAFxGtGWaFN5A-y4XzC9NEcxKHbvClnvRv6FLq7ascA387hH9qJq6abzIBt6ucNTiR0QVKIYGLyqLqjuPdeQdk9Gh7Bu0mQyhqfijwtmpGi9a0cvwwvyZqdHHvOxQ99XStU-w5w10hPdKkdPkgikyOl-W-Ax3BCYL2xpEiPajhT5Pp-YkLvqlmB-oNnN3O-m9OpSIlsdcJrYdhTBof_0XQ0TH-q2Mdg6xvsrilvKvVKXEhLd6G23Ft6cr5YPwv3IKbFOzObWUxrwHMdkj5QWQUpJ2LGKuRsIvFCIeOsgHuJV2AoSyZYTDiB45hQVrbK9utXoW2C38_qbChxhkK2AqXtvKG2CBAucU6IrpUSItbt108DjZy6z3lX2fqoLAJh0Za0LPs00FqXCbsEWKEcXe3jIdTxxoj9vMnwN-AdZ19MCdAsS2V9a46Mi0U5mUYy4TFSXwT4e6SWGFuoQWFDPfvNu_QGYAAJ2koRxohLly9Pe1V22OvTzTognSoW5M2u1i4ZhgEAP8hOQFrMWtZGZMRo3YpAJ21yx6m_mtsVQDjT5ygf_0BwRk68hMzxuHUx9Got0ijq64Jx824EyC9NXk_L4cqPlpNXbe5rz1L4J7ujzgVTsAgsmaB0M5EBXFoFC_jOzTX3B8R4bR5KsbaRizQCC02N3nIN9ieCyLXEzeQQhaDeLNvWtqZBJDoSi07FoT33WQzoPznHsv78WOY8XevW0kX4DYkyJP5Don_qLOadYT9Kx5oU2RzwufLRVks21dYaYDI7mnJHpqrxicCtChUk3RrRBhu23-25Drpzl5sclAvTeKncaqMS8_U9LB135LY1kXgLBjeFE4nSbMXuffngOIRtc8qqXwaL2Q2Op1AKzAyl6uYdTIqxDOSSUPZUegQiQK_nsqkR45Asd0k8TGvh_bt3G075SV6qZkjl7s991B2AZRsPvJTspnRqwAQNV3V2aqrtDjV92T4zEWmadtpCjmwEKQQGgxUl0WQm3splyeUQFJr-n6XUquYDYbdFvy_HUzDel_OeQYC1kVprgwQXXQKMBinsavswlsVQtQXZHSlML1jO7skzUmOKYiIUpGqpOkwzJXqBkb322ZHA4aAe7n_l76w9ZIYR1OlexlRrF8gp8vJl_JvAkG4NKiYh90DOPsW_VWfwIOcb4ojidR74YuidAhUU0XZ9t5TCBbB4zdmriuToYzx6o_YR5JmyyWjUIdQdFnVRVX5SDcPyv0B0hVgUdg8D1kOwWMnGlVyeMk_JLhzBjrpiQ3F17mL6f_w2Xm5jFLYlspR_DSa8OJQSnLZncpTbJdxHmrqKruhnDjMckS4NfQIJuub7y5kNSeC_Alqrt97OFBU9R5bdpCB6P5m89WK41d_uabOfmX9ac32gLhFcLHQdgstqwUgjPt-VY3yZLlhIa7Sq9uzvTlLpTBHuwmPgKWabGsF222tGQq2BEKjvtGpiQijPKTEoo16fZKEsnpwutELW17cnSoUz_A9cIvJCfcgrAdrSz1JhteXaxIkUfrVLMjMhEt2cJajyI68jN6t1gclCLRfx53NmC5GOVQLhcezOLYYf9gFiLEkQ5zBWEz_mKR49NmNM-RPVO1IMxitvuAh-sIGoa2_ocPuY8Vu5s5EyGAwHVfWclGVM3ZgTEqZheQg00qE6WSpYn7a6t4jaC_GGy4ex2iVNnmAT3h4WkwgrH5AYwvrNCn4jTYtJsovc3e1dC4ghFqWqL1KUdTmNxPQvB97I95vXEfXdT0nMp0a7n6nwYWYze35INJoxl8LjW-MnIv3o1K8fWhBJg2KnZNIeStxycm03S0ynaHkv0ySxb5PJ7kizCrnvP2zqAdUql2bhS3J3HqwDIixwGK4aCG-LHli6Xk212JmX7JHF7iuDWwfIoGcl2DUsdxP8YJFzNnsIpzV5C8YbRUDo3yQIirlT3h4ciGTS_yp3IXoq0ZA2Pcj_x39FHyEasErNtK_mnYZReDUrMgNpvfZGS76upNOE3RhqEE4voqk4Kkd2lPiriDcT4VezU5vlE2FGQimrt8WwN9k-Y6nAHvwV-sUmvJO7b2oR0iGE8VzDNIZt_FP-bzf8fMoEhuUuEVLmGz6I-j5Zmr5s64CbxoZL1HqQoEZ3jCIkaE39oTiXCDf9AXG2FbBvAsZTS17XGmIQt-6sO6Z31dfj_GRMhyRRzNYV3VxoEzUOkIGb9aN8x0TBWzHy1GDiCE75lf5mYoTEu2vvWjtToKOCwXA3oyh_nRLDfpxkvgEMJrbFBZ3tjrg&cid=CAQSOwAvHhf_-UC5edhqfpTtDBXNWFZCwLwrlvGuo3o98_wcgxU_jtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2F&ds=l&xdt=1&iif=1&cor=12719247477613752000&adk=521587873&idt=114&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3de398f36b22e6bcdc94600f85e3a935313bf76997254aa2aa8e0d787eb82ce6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19929
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 4E60 208 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f53d8e59be5dae1054977a40ff75f7abed1dafe3d5e23feaf25778644d151b7d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 2C06 2 KB
1 KB 14ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZYwUXQAApS0A-RWtAAF2oUxGaJmITHjxcUWj9A&u=%7Cho9F3x8XBfp4va0t9VmGXagoRLX21UbHqJL6j4RrxD8%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC866nFjl4YrFP14DeBL3lPpEnFxTCHNntV3tTRJG5kiqHsNhuTRsSA9A5Eeu0uX3uB2K1Pa1dXNeig1OuF8LVfPCXw4x40C5Jg0OaAUx6HtvyMwL4lfeliXj65fKn3f72Y4X15t06LOXSmB5QccEmvtkRWpbOgIlfN89m7vLtQ95UmgXb1ImcC1q4pzko13Gz1JzB8q51xjYsVaNcB0d_iKoIGGqE8R-1TpZqQN6usl76VHLOYDHw_1nh4f1tM7EZhvE7fsXbzkxjjL6-s2VTEXisbPcBhrB_b2AX8KbqQtUmXK18OBHyU9oCf0YSYoAqNZM0pFW9arCn3Isdyt-rTdBjAKO-jwaOrneMGlncDNLcgIUyPhqSJX2QkJW44vyj9SINdzXR2uxWhxxj3l75NszGOs4DqUThQz1xRQUbeGCANo4uBuw2lr3Kpq-jv3d4gjpeBtqR3dnpvmQS4sARK3-XPeWxBPqjyO-TPE1YOu8G54Aq9VqNJP9Yz6jtBDEbqL4htb0C2aboq6OzhYEXUoYfY_py0zUCOd5Qg6mQwyAvsZ4pLJ-lFoRd8YBuxiFYujg&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCmYP-XRSMZa3KAq2r5LcPoe2FoA7JntKxXM2jlvdwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgT4AU_QZx_OVkWm3g_thgcX1Tr24SZF5fHXfdSkcvfjrLk_87AEeoEmAzcwhfilXkG3Kz5OTRSV9vNgBxPcF2OiLkTb5a_us6kv6i0szrp3NmMiZeOJ4rLNc9UrBsiWQ6wyBvVccF7YgZhxia4Qbuh0XM3xrdLKcQv2w_zGbcDV_s6yGPaxwW7Fuizv_PNB9NUMDgghAF9FuGbdcgBz1Yd7mMVIhL72s-7yO-hbgQgsahfhaHbhKG5o23Dx1OHsXdXXOlXT2mfHOoMlPKT-BJeV3jl9IhsE972DLWgI-bt6CNAo2mrDOwh9ulE8J0_uu16alET7Gdx3PCsMgAb1p52QmJX-uHCgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpYzbvejcuvgwP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_2T00DLE69CP76weXHcvCm48hpTDA%26client%3Dca-pub-1784742484268469%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 2C06 2 KB
1 KB 13ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 2C06 308 B
636 B 13ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 2C06 293 B
621 B 14ms
14ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 2C06 43 B
347 B 14ms
14ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=6glrRd6CE6D-1zVCyUDLT1rTLHQe5oBeQiqT9z6cqHj2Z3Pj76Wl9DdfbLU7Z3exr1N2rfNn-qmd-AtkW4XvxFJln7ekX8kCpTNUjaATUhmXR1BmV9l5vuoR7xvBfVLzpWx1QzhYpSo4R6RWlUGxSY6LFW4Yo-EOYbM0ZOkSX-DbwLJgeKL31Qrtv0Z8ex0DTNiTkrHXvJ8MQoFS29IJEKBZ29cwkC2MqHpw0lX6-A6k1IY14FE6iGNLkpkynEo6v0XBvn30oTiBXFxTt7T__YIbm3_OrKHxSYePr2tCfUDHU-krQs57hCFMbkIbhDTWSkEfKt3wjFXqi2fQeSxqwjJe_1pDLenOn95GnW5zplX9OWWMyqg615L_J4L1SbsmjaNpRFa4fSrPfS_km-yiZFr9IPffqLNqBsGNs_etCjkcP2uwlb6XsqIosDgFmyX7rUClcQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1821824
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame D9B3 42 B
64 B 46ms
45ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvz2CWkdCyxTCFYPjdO6R0qhYMiiYtz-Iwd70AXhVlE92w_v2XG2X2jDKMsEJAxBT_U2IevSoPgfAodwsOuO9-1GSJG8__yyaAUli8PfnPaLZ3w-FWCrqAlyJhDqUvUPUxlDOuhFeXo2obiRWFUq8nV-IDU&sai=AMfl-YR9FG5uE-yjfkXdWytL_MHrzpD9ZXwnWbReD0WLicldpVjTCckdy2N6YEQ8kxUlyoTnwhTmYiay699IacQKKBMq5wKo1_3521ijJAl_HMTHvAXMj9HX345OrDPGXiI8cVOWp63RCTnFqSblg7nNwg&sig=Cg0ArKJSzAkSZADkJgp4EAE&cid=CAQSTwAvHhf_8WcLfhFR231-G6wFO-BNYmuvttGhe_7Kiy99i8ZaRApGlaK7t8wq3huQ9sAsxpVazNtOC5I7yXyFmbwibYc3iZ9-DhLvpGbqNJgYAQ&id=lidar2&mcvt=1022&p=0,0,280,1200&mtos=1022,1022,1022,1022,1022&tos=1022,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=3954062228&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703679067367&rpt=1288&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 8B71 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8a45d84ae8e3dd971a5827d53c55843cb7fe3babe331e495de9c4e93963a9d36

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame CB89 8 KB
6 KB 49ms
49ms XHR
application/json 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fab126ac385a82074a5389004cc908e134019d4e5d8a75631edd7313bbe6834a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5921
x-xss-protection: 0

GET
H3 200 B30443038.380567266 Show response
ad.doubleclick.net/ddm/pfadx/N7657.3553448DISPLAYVIDEO360/ Frame 6883 42 KB
16 KB 47ms
47ms XHR
text/xml 142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/pfadx/N7657.3553448DISPLAYVIDEO360/B30443038.380567266?ves=dGltZXN0YW1wOiAxNzAzNjc5MDY5NDkzCmNsaWNrX3Rocm91Z2hfdXJsOiAiaHR0cHM6Ly9hZGNsaWNrLmcuZG91YmxlY2xpY2submV0L3Bjcy9jbGljaz94YWk9QUtBT2pzdXNTMWJYWXh0dTl1ZUREdWVDcHprMlZnU0xPNkczYm1wbzFJdkozME44b3BHX3ZsaGlCUkZvSWtFdTl5ZFlQM0Zqb09IQW91T1ZTS2R5QzBwODIwbElaRmNfRFZUZGw2aURrcUI2a09CVjZMNVpORG14ZFllc1V3Y3kxVHRhR2tZQVNrZFEtXzVWUFRnTlRmYm5uTkRpTDZvSnk0T0s4UWNrQThZN1FVLWh1UmVOczZua3FzNG9sRmNFRDNxSVFMTjdLSFN5MFhuNVB3aTFfZXpqQmRCYURMQ2FuejFZZlY1bHdfQ01sNEtaNXhCUTMzb1JfYmJrVEVRWHRyZi1BZ3NTN2I5NHRLTy02WXRyRWUwWDk5d3NuamRrNkhIZTgzWHllVHZDanowRGtuTlRrZzdibGlacVpUbzhhUXhGY3hWTWVYdHN4Y2lHdDZFbVJLaFZ6ZHRTM0d5Qk5GOUgtZWEyaU1NODAyVWpvTXdCbFNxODd6SWJIdWxLYmZqX09OdnVyeHBpbjhoZ0p2ZHB6LTlsblpjTG1OU2prSkI0OXZaNWhWUzYwdEdkbGlJM3A3cHp5QXU2eEJReExEWEVzcENUMy1vU0VFTFVyWDMwSmxSNkdmUmdBSXoycjltOTRvSFdpZnVuUnhZcTdmUFJ5RXo3X0R0anEtQ1VVNG1aZUhXVzVsX1V2ME9TdTdXWVJGem8zMU5aNmpFMDdBLVlhSl9JWjJKV3JEQkcwVGkya0hWYWw5UmpDZ0tGajVQV3BmQTNzVkhXSUFzLU5tRlczOG9FbURvVmNYUExtdnNWa3RQdTNPU1RxR2tCSHlBRy0weVpQNm5PRTJab3FvQjFkSm52NmQxVTJNMU5fc1M3MzVQNjVqOC10Wm9LWjVTbkgzNXdCc1cwNzhEOGVmSEc5LTZyUnFYeEMxTlpZTGFSVGxnR1VwWENQOW5DTnlxNGVpdW1mNFlxRWNBMEpSWVZzM0V0dVdrUXBRbHotZnJMclZfRFVmN05vdE02R2ROZmJVMWphd3FOdm95R19acE1XMW9vWnFLejNRYVN5S0RRYmJlVXlNbkZYVUNvT2dUd1dKVVp4TmNDcmxMNllMVFpMbk5IRVFuXzZYejNwOFZFeFI0YUM1alM4RktSdDdQX1RRbU5mdWxBa3FZWmpNMm9xZC1Wcmh3Mm1fWTRzMmsyMUs3cnpvNU41VXZXd1lhUmotRTBnR3VBSHNlM2xpRDh4eVhnaUdCV0dKeFJEWXF6a1A0TmhhQUZHZk1KWDJ0Wll1ZjlmR1Z2b1NYRWtCVXVlaW9ZaW8tbldqeF9tSnlBQl9CS1p6YS15SHJFZ29YNlFEcHJTbFhKNXBLVllvWUZ1Z2VJNnQzVncyMUVFMzU5dXBnMy1LTkF0M19STjJWWUhEdGVseURSM2FfOTZjWXp2Vm9JLTdZM3l3d1VONnF1Q1ZpcWlseVlRdlAxSlFrM2JrVlBDWVJsZVBzbWh4NzEzRGMzY09tTTBHMTVKZ1p3LTktUjJLZUYxZkVZbTdsLXpMS1pYVS1SZ3lLM3JnOUpLM1FSMm1VWHBMVzNkcnBadWVkNHBLRVl1TmY5RTZTQkszbHVJNGpDQXh1ZFBmSDBzNVRnLWZjVXJ0cXkwYzdfcXAyS1E0VW1hSklUS0duZFUzNmszcmVidjJFOFZ1Z1Y0dUItRlRpaUZnWXVQblF1WUFsbk12cHZGdDN1WGlHQTFPY242Nk5TSFQxblZuY1RKek5ZLW16LUhNZDhQbWdiQ2ZWYkhZQW1zNXl3OHRZUjF6RTRZeU5jTnNVbGpfbm9WRWN1eVV0NHRNSSZzYWk9QU1mbC1ZU2ZoNFBzZVFaclZuZUhBYld4MC0yMTBDVEdhVjhzZDhGR2dXMTdlcUpPZmdtUldpWTN3TS1uejBkTURSUTkzQ2tVZEtBUUlxMHdZQ1VFX1JnTDJrY1BYWkNxaHdtaGhBMGFKS09NWDZ1Q19XRzJLaDBMZnJEMnlVcjhaMVlBOGdpb21XMjdRY0dIYldXWWhzZlZscXFKQkZXNXFkX2N3dkZSdUg0Yk9QS1VjTHQ5ZG5PSWh3WWkzUGgtaERxZ3p2ZE5yZzI5dGJmM0xyWE5mZExLcFJrblJmM3Vmc0d5NTlYMTFBV280dmdyOWxDTUVmWXRWQ2k3UmNvanZ1X2tlS0trVUY2V0JLdlFqMjF1SkRKUHlZaUZ2WEp2dGpVTTFHdHYtRWdiLURCbzhTXzZWa2Mmc2lnPUNnMEFyS0pTeklNRDdLVl9jZTNZRUFFJmNyeT0xJmZic19hZWlkPSU1Qmd3X2Zic2FlaWQlNUQmdXJsZml4PTEmYWR1cmw9aHR0cHM6Ly93d3cuZWEuY29tL2dhbWVzL2VhLXNwb3J0cy1mYy9mYy0yNC9mZWF0dXJlcyUzRnV0bV9jYW1wYWlnbiUzREZDX2JyZF93d19tNl9wcmdtdl9kdjM2MF9tZiUyNnV0bV9zb3VyY2UlM0RkdjM2MCUyNnV0bV9tZWRpdW0lM0R2aWRlbyUyNmNpZCUzRDczNTk4JTI2dHMlM0QxNjUyODkwMTQxNTkzJTI2ZGNsaWQlM0QlMjVlZGNsaWQhIgo&dc_cid=206729091&dc_adid=572283934;sz=0x0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;dcmt=text%2Fxml;dc_sdkv=h.0.0.0;dc_osd=2;dc_frm=2;dc_sdr=1;dc_ref=https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html;nel=0;vis=1;dc_sdki=445;dc_eid=420706098%2C44752538%2C44807615%2C75259414;ord=[timestamp]

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26cb1bb12552140ce8ccecf6f8224c9119f3103477ed02b304b32a04d4868ddb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16379
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 2C06 12 KB
6 KB 16ms
16ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 0d5410bc9c3e437daf6999836d04f18f_ubuntu-medium.woff
static.criteo.net/design/dt/ Frame 7D40 38 KB
38 KB 17ms
15ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/0d5410bc9c3e437daf6999836d04f18f_ubuntu-medium.woff

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ce8b0ce00b853304b4500a3e0273c2ee8123ec998d9ea4bc1a2b3e97c573b61f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 02 Oct 2018 14:57:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5bb38755-97a8"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 0d5410bc9c3e437daf6999836d04f18f_ubuntu-medium.woff
static.criteo.net/design/dt/ Frame 9DE1 38 KB
38 KB 22ms
22ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/dt/0d5410bc9c3e437daf6999836d04f18f_ubuntu-medium.woff

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ce8b0ce00b853304b4500a3e0273c2ee8123ec998d9ea4bc1a2b3e97c573b61f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 02 Oct 2018 14:57:25 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5bb38755-97a8"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8B71 0
19 B 54ms
54ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CZGZpWxSMZcuyGeqJ1fAP7p6tmAfJntKxXJWil_dwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgTuAU_QxHmAb2NQF8Iww4GXMSzynSccZo16btRN2sQ-YQBKR_xNnOS7sHJkUSo15XFKYkWSqW2AcWj4ysszspGUy_m-WsVVJtYQa_wt8_0r1_YtTssUDhH9Q5UQXCMF47Pk9wlKwkG0NVEte5FAbWM9xCha9eDy0pXp0o_iVaIGQpTT5GReD7-GSM6jaUkrWkcDfDbkjrt2V3hs9rqWNIH97rbYVisi_6MySBq_DRrEggeBTjGxVfxYd6C38v1Tl5wbyi4h2KbHKKtz3vFcAOeyP-NBp0R0_YEASIZ7FsknVVemLoU5hm05a7OFUbtN3byABtyKgb2Ag8b3tgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpY06H_jMuvgwOACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMTc4NDc0MjQ4NDI2ODQ2ORgA&sigh=Qd0VeS0k-34&uach_m=%5BUACH%5D&cid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4CeKQXLA9bJVaZFlgIrMnDuXqopeYV2GSGBjnBgB&cbvp=2&vis=1

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr3.eu.criteo.com/google/auction/ Frame 8B71 0
126 B 64ms
21ms Image
text/plain 2a02:2638:d::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.fr3.eu.criteo.com/google/auction/notify?profile=14&payload=kKW_EMz6RMgB2ASdg2ICAgAAADLTrpMBxaBVEFsUjGWbIa9vjdkqAAg9AAASAAAKCkFRVUJEd0VCRHc&wp=ZYwUWwAGWUsIFUTqAAtPbl2k_PySlN0UqenGHA&cbvp=2

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 154860
server: Kestrel
content-length: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4E60 0
19 B 53ms
53ms Image
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CTIRIWxSMZcyyGeqJ1fAP7p6tmAfJntKxXJWil_dwwI23ARABIABglaqzgsAHggEXY2EtcHViLTE3ODQ3NDI0ODQyNjg0NjnIAQmpAuyrMh0zh7I-qAMByAMCqgTuAU_QUnPrb3Bth5w4DEMdE8jJcsSJckLxRACpQ23s7yH44xRuFUdAMXhUc5V1isa5iAuLm3mwdKrBPjXa4enDWUy_yDrJ-vuOIKMzpLNNWPnk2PwjzH7vn1-fI3ufBh4_Fe261L6OAJiZop0hR6Yu36vRr1uTrpyQigp07rQ6KLPyE3UDs9wAeJpOJQK3qnzswmWwsm7oeT7iouYYTd6aekjSPiA5gKfdDh4DfC36lvIohoX2dLNbqJy5uyEF-ssPl52rcKBbKXbMEQ4F6xfF5pYhmBUz9_HUCnwYjVpZjK42CcbDyNDHq2mCvrVPn16ABtyKgb2Ag8b3tgGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggdCIDhgBAQATICqgI6AoBASL39wTpY06H_jMuvgwOACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMTc4NDc0MjQ4NDI2ODQ2ORgA&sigh=zGh7xtslFbs&uach_m=%5BUACH%5D&cid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4CeKQXLA9bJVaZFlgIrMnDuXqopeYV2GSGBjnBgB&cbvp=2&vis=1

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame 4E60 0
126 B 40ms
13ms Image
text/plain 2a02:2638:3::9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kKW_EMz6RMgB2ASdg2ICAgAAADLTrpMBxaBVEFsUjGVYAFZYs_cEC_48AAASAAAKCkFRVURBUUVCQVE&wp=ZYwUWwAGWUwIFUTqAAtPboGvnllzPTU6XUGrEA&cbvp=2

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 142417
server: Kestrel
content-length: 0

GET
H3 200 prod_studio_01_250_videomodule.js Show response
s0.2mdn.net/879366/ Frame CB89 13 KB
5 KB 8ms
8ms Script
text/javascript 142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_250_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03656ff565d2cc90c3b8f2c1963c5804304e5d9dc796e920db21a6db906a942d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16661873397665731963/index.html?e=69&leftOffset=0&topOffset=0&c=bvb13SSQfz&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 02:12:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35894
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4955
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:43 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 28 Dec 2023 02:12:55 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 9 KB
9 KB 59ms
28ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=276&m=0&partner=3018&q=80&r=0&u=https%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F3018%2F5193633%2Fe67df1b4f160448182e75ba3f8786477_logo_n_horizontal.png&v=3&w=396&rid=4&s=fKNZ2BxzWyyEAU7qsfrQ_SEw

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fc29c04e8b33070a80736c06eb809f1077831e2d8799b52bb49ca4737930abb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 9343
expires: Sat, 14 Dec 2024 09:48:03 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 158 KB
159 KB 75ms
44ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=1200&m=0&partner=3018&q=80&r=0&u=https%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F3018%2F5158051%2F940410f24583445bae9157d36ee45661_img_square_1.jpg&v=3&w=1200&rid=4&s=yloOg0XTugo9OjnM7J43VKo8

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

d0ec4741d4baf0ffcb2705890339a373cf5e4939a632ebfb63aacc00ddb46894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 162204
expires: Sun, 08 Dec 2024 16:06:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 8 KB
9 KB 71ms
41ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1690302959%2F23124100-o1VFALwj.jpg&v=3&w=400&rid=4&s=PGIMVDLSZ41M93zs6z_g0bCW&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b22e1a648010a46f0e94a3c9e766c826383499b542d5bf05284ca911a24b2ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 8518
expires: Tue, 02 Jan 2024 20:34:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 13 KB
14 KB 65ms
35ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1574775823%2F19171363-YFc4KcwM.jpg&v=3&w=400&rid=4&s=RVTrlYxQ3oYjQTYAKhbGWbTH&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2d185eb744e6c3b5a96ad5059e97a0dd5faa6762a4b348c3a928d2e465715b22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 13706
expires: Wed, 27 Dec 2023 16:22:49 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 8 KB
8 KB 65ms
34ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1663918802%2F22161368-5TnFvicF.jpg&v=3&w=400&rid=4&s=hjKeAgb7YEBy3LbXYchBAmix&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

14d7720948342bf9e078d228fb2ee3bc193699fb18328f3e27369470fc53979b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 8216
expires: Sat, 30 Dec 2023 07:08:15 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 19 KB
19 KB 53ms
23ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1630304923%2F21150256-Z96iaNGm.jpg&v=3&w=400&rid=4&s=VBxlwfY8P6T73e24JrLAZkXw&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f80a50d356322578569175a58bc83fd9640efb9e994cacf38e5e7164aca7c5a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 19054
expires: Tue, 02 Jan 2024 07:32:00 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 20 KB
20 KB 55ms
54ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1667482013%2F22217333-aSJQXYz4.jpg&v=3&w=400&rid=4&s=T5eGZe1pOftub7aJi_h0H_fb&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e162e82958f0afb7bd30d631c04a4f47d0693f931e7d44fa4c7c6c0a872b7f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 20502
expires: Tue, 02 Jan 2024 07:03:40 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 10 KB
10 KB 51ms
51ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1660225633%2F22167963-8wWIhwnO.jpg&v=3&w=400&rid=4&s=Ttd1nTPwNQMKCxinKQBKT_Wi&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

328bb96999971ad6cf3fc46e8dcbbcf7acc33ebadda0995a28ec60de4acca7a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 10396
expires: Tue, 02 Jan 2024 07:28:53 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 9 KB
9 KB 70ms
58ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fc29c04e8b33070a80736c06eb809f1077831e2d8799b52bb49ca4737930abb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 9343
expires: Sat, 14 Dec 2024 09:48:03 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 13 KB
14 KB 71ms
59ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2d185eb744e6c3b5a96ad5059e97a0dd5faa6762a4b348c3a928d2e465715b22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 13706
expires: Wed, 27 Dec 2023 16:22:49 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 8 KB
9 KB 70ms
58ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b22e1a648010a46f0e94a3c9e766c826383499b542d5bf05284ca911a24b2ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 8518
expires: Tue, 02 Jan 2024 20:34:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 10 KB
10 KB 40ms
28ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

328bb96999971ad6cf3fc46e8dcbbcf7acc33ebadda0995a28ec60de4acca7a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 10396
expires: Tue, 02 Jan 2024 07:28:53 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 20 KB
20 KB 64ms
53ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e162e82958f0afb7bd30d631c04a4f47d0693f931e7d44fa4c7c6c0a872b7f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 20502
expires: Tue, 02 Jan 2024 07:03:40 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 99 KB
99 KB 66ms
59ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=1200&m=0&partner=3018&q=80&r=0&u=https%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F3018%2F5158051%2Fc0e49f1076ca4e47b93a2daf6a82e941_img_vertical_1.jpg&v=3&w=1200&rid=4&s=VSJRWNlCwv0TqbGoWAxbJWsQ

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

786115da818c5a80e1d6959c0a191267ca7b84f71435a20508537aabeb4612a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 101104
expires: Sun, 08 Dec 2024 16:03:04 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 16 KB
17 KB 50ms
48ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1663166615%2F22193040-ZFUxqELs.jpg&v=3&w=400&rid=4&s=lPdOpTee_EvN-B99nTZFylBT&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f7c73f48c83f29d6b257a259d8e634740f4bc0ca6f872497f96341eb4c9e7183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 16846
expires: Fri, 29 Dec 2023 13:36:24 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 15 KB
15 KB 48ms
47ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1702990437%2F21300290-8z5Sd30T.jpg&v=3&w=400&rid=4&s=PRpfVQ_xDGQB4e93UrwH_6cu&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

6c79dc95481593b76c941133ebae36f18960a9017a4be5046de282aec271836d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 15058
expires: Wed, 03 Jan 2024 06:48:57 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 27 KB
27 KB 47ms
46ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1657873777%2F22143849-ybnPE1fj.jpg&v=3&w=400&rid=4&s=3mf6Ri1kp9pPiT2bIwLYF2w3&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a386b4f34ae910a7c21be6bd3aae679d902eabb6bab61efc1777279887a22a76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 27584
expires: Fri, 29 Dec 2023 16:20:56 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 19 KB
20 KB 47ms
46ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1695538909%2F23182731-a3Bn0Ypi.jpg&v=3&w=400&rid=4&s=XfV_5SdqTiMVs1Vku4lvQuCi&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

cc6cee8a781483bd64e735ba3a468e3eec78501f14000430305c07921e4c0503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 19834
expires: Sun, 31 Dec 2023 18:10:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 9 KB
9 KB 50ms
49ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1576231910%2F19302960-knlTWGZ4.jpg&v=3&w=400&rid=4&s=SCy8cikf8OC6Pq0kD7MxxvU2&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

3c74245512a97cf63d9856d6b2d48b55c8738d4a88eb5856fd0247faa7bd04aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 9254
expires: Fri, 29 Dec 2023 16:27:32 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 18 KB
19 KB 48ms
47ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1703169856%2F22254685-pcvfcjwC.jpg&v=3&w=400&rid=4&s=iSYnoJFThbYsFWe3CIfxp1P1&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ef729bb645f2e2604a1e423bd1ce33a23905815679b29ae8f3a37971170a8032

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 18864
expires: Fri, 29 Dec 2023 06:52:10 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 25 KB
25 KB 49ms
48ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1695016198%2F23162497-l6JAzBcZ.jpg&v=3&w=400&rid=4&s=70pRzTw5rlXMl8H43XTB-w0x&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7391010b1ea7ea1de4acfdf41204af9191023ff870d522b400b1a988ab4ac608

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 25596
expires: Fri, 29 Dec 2023 07:39:48 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 13 KB
13 KB 48ms
48ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=3018&q=80&r=2&u=https%3A%2F%2Fimage01.bonprix.de%2Fassets%2F1400x1960%2F1657811954%2F22136350-gYSoGjSG.jpg&v=3&w=400&rid=4&s=Ry_Sj3rKwgLOp81LLfZEO2Sm&b=400

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

33101326f608f4024f1d1b452628a439dc86a6e8031cb4331de511d0c1a4a484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 13018
expires: Sat, 30 Dec 2023 12:57:47 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2C06 54 KB
54 KB 53ms
51ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=556&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F105623%2F5022139%2F2ad0250af6b64105b12172cc0682064c_eu_oveckarna_vertikalni_hneda.png&v=3&w=528&rid=4&s=ivw_bvHA_3V0TvjH4yeRBukD

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

32bb6bb95ee0cfe00efcc89ac8aec81afa338173a5f8323653fab2ddc97e1849

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 55005
expires: Fri, 06 Dec 2024 08:34:40 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2C06 13 KB
14 KB 52ms
51ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F0%2F13430_102.jpg%3F1652958217_2&v=3&w=800&rid=4&s=kPZ1J4epTgD4-dpCBYUikuK_&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5b0573fc288c40dc35a40b2a4f7ef0867a41531e8d44961ffe670aca5be58384

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 13728
expires: Wed, 03 Jan 2024 11:21:57 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2C06 19 KB
19 KB 53ms
51ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F7%2F9747_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=isLH-aZOaI_JYFgESiQHfOTG&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b3158d5fcdc230f5c988d1e0addd7f6d078f43256d5ee2a87f931bdd31682336

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 19366
expires: Thu, 04 Jan 2024 00:00:42 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2C06 15 KB
15 KB 54ms
52ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F5%2F14345_102.jpg%3F1660025517_2&v=3&w=800&rid=4&s=ToubCQOxJDOscaznaUlbQfrk&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

36c4f072d3c0284654277f864fb3c2d4ae52dcb98a5004ed49a502c58dd3c20e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 15454
expires: Wed, 03 Jan 2024 22:03:08 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2C06 5 KB
5 KB 53ms
52ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F1%2F7251_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=UcMb0hTRBPetSdYXEmqKQOqb&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b2d86591ab53303e9e0c27884fae0716c990c8585ed173a496589b198f805aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 4934
expires: Sat, 06 Jan 2024 11:59:41 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2C06 5 KB
5 KB 54ms
52ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=105623&q=80&r=0&u=https%3A%2F%2Fstatic.oveckarna.cz%2Fdata%2Ftmp%2F102%2F4%2F3984_102.jpg%3F1635951174_2&v=3&w=800&rid=4&s=LvSGp77XHYM3aCxBW33Fot_a&b=800

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

571d48ec93ebb2b2704eba96934142a5f05c66051989fcb725cee2d1d343297e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
timing-allow-origin: *
content-length: 4608
expires: Thu, 04 Jan 2024 15:13:41 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 2C06 0
127 B 14ms
13ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=uUARVbxWDoCsW9HOMk8XYglvaynNKoRuPAEtCs70hyhVpRQKX-8KXxlui9m2SGhiOut35lJ4Ia9NgZqzIO-6EfBRTlt2gl8KjoA20tb0H7_uvY0r1vlQNRxdWGcf2CGkf3__SLsvHhaaH5PLZpsGA0zXiWpH07ejr0YIKTlTdVxAY5HUfYN0eR60KT1V43kUF9mSm6y8Wg9Lv57SQI-6Lo1esjqVJlVZmICXIX554EmwNyTkikYuUxDXvMN8K5jGB7jyog&sds=2&rev=89863&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 2C06 2 KB
1 KB 14ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 2C06 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 21 Dec 2024 12:11:09 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame CB89 17 KB
6 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 27 Dec 2023 12:11:09 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
54 B 272ms
272ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lqnqj3ak&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&vmfc=13&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 6883 41 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 09:02:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 97727
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 09:02:22 GMT

HEAD
H/1.1

200
OK

file.mp4
r2---sn-4g5e6nzl.c.2mdn.net/videoplayback/id/32ca47640c8a13be/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3846240834/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 6883
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/32ca47640c8a13be/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3846240834/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signa...
https://r2---sn-4g5e6nzl.c.2mdn.net/videoplayback/id/32ca47640c8a13be/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3846240834/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

68ms
8ms

Fetch
video/mp4

2a00:1450:4001:3c::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5e6nzl.c.2mdn.net/videoplayback/id/32ca47640c8a13be/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3846240834/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/0BAF7252DC61585E73E69067ADD2EEAECB4808A4.3E0C216D8979FD992235895332BA2D84984830E7/key/cms1/cms_redirect/yes/mh/bJ/mip/2a01:4a0:2b::9/mm/42/mn/sn-4g5e6nzl/ms/onc/mt/1703678196/mv/u/mvi/2/pl/43/file/file.mp4

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:3c::7 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Wed, 27 Dec 2023 12:11:10 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 1715588
Last-Modified: Tue, 05 Dec 2023 16:11:35 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Wed, 27 Dec 2023 12:11:10 GMT

Redirect headers

date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 644
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
location: https://r2---sn-4g5e6nzl.c.2mdn.net/videoplayback/id/32ca47640c8a13be/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3846240834/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/0BAF7252DC61585E73E69067ADD2EEAECB4808A4.3E0C216D8979FD992235895332BA2D84984830E7/key/cms1/cms_redirect/yes/mh/bJ/mip/2a01:4a0:2b::9/mm/42/mn/sn-4g5e6nzl/ms/onc/mt/1703678196/mv/u/mvi/2/pl/43/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://googleads.g.doubleclick.net
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
54 B 271ms
270ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=5~lqnqj3j4&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=2076&mt=video%2Fmp4&vs=1024x576&msm=1&aits=0%2C18%2C22%2C37%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=347&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.1wk~videopreviewvisible.1wt&ua_e=1&ape=1
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

206
Partial Content

file.mp4
r2---sn-4g5ednds.c.2mdn.net/videoplayback/id/081d4bf865be3e35/itag/18/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1735215069/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,... Frame CB89
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/081d4bf865be3e35/itag/18/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1735215069/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signat...
https://r2---sn-4g5ednds.c.2mdn.net/videoplayback/id/081d4bf865be3e35/itag/18/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1735215069/sparams/acao,ctier,expire,id,ip,ipbits,itag...

335 KB
336 KB

68ms
9ms

Media
video/mp4

2a00:1450:4001:19::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r2---sn-4g5ednds.c.2mdn.net/videoplayback/id/081d4bf865be3e35/itag/18/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1735215069/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/830A749524665CFCF7DE16D2780F932DDE45E9E1.49D1A89893B5D8005B794CB0392F0DCC74DF26EC/key/cms1/cms_redirect/yes/mh/j1/mip/2a01:4a0:2b::9/mm/42/mn/sn-4g5ednds/ms/onc/mt/1703678196/mv/u/mvi/2/pl/43/file/file.mp4

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

HTTP/1.1

Server

2a00:1450:4001:19::7 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

49dc5234ece8c1da03b4056d8c957f399f7aaf40a6ab0a14a54149e8f8cd7099

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date: Wed, 27 Dec 2023 12:11:10 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 25 Oct 2023 13:43:28 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-343270/343271
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 343271
Expires: Wed, 27 Dec 2023 12:11:10 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r2---sn-4g5ednds.c.2mdn.net/videoplayback/id/081d4bf865be3e35/itag/18/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1735215069/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/830A749524665CFCF7DE16D2780F932DDE45E9E1.49D1A89893B5D8005B794CB0392F0DCC74DF26EC/key/cms1/cms_redirect/yes/mh/j1/mip/2a01:4a0:2b::9/mm/42/mn/sn-4g5ednds/ms/onc/mt/1703678196/mv/u/mvi/2/pl/43/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 643
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 19 KB
19 KB 13ms
13ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f80a50d356322578569175a58bc83fd9640efb9e994cacf38e5e7164aca7c5a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 19054
expires: Tue, 02 Jan 2024 07:32:00 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 9 KB
9 KB 14ms
14ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fc29c04e8b33070a80736c06eb809f1077831e2d8799b52bb49ca4737930abb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 9343
expires: Sat, 14 Dec 2024 09:48:03 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 10 KB
10 KB 13ms
13ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

328bb96999971ad6cf3fc46e8dcbbcf7acc33ebadda0995a28ec60de4acca7a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 10396
expires: Tue, 02 Jan 2024 07:28:53 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 8 KB
8 KB 16ms
14ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

14d7720948342bf9e078d228fb2ee3bc193699fb18328f3e27369470fc53979b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 8216
expires: Sat, 30 Dec 2023 07:08:15 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 13 KB
14 KB 14ms
14ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2d185eb744e6c3b5a96ad5059e97a0dd5faa6762a4b348c3a928d2e465715b22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 13706
expires: Wed, 27 Dec 2023 16:22:49 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 8 KB
9 KB 15ms
15ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b22e1a648010a46f0e94a3c9e766c826383499b542d5bf05284ca911a24b2ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 8518
expires: Tue, 02 Jan 2024 20:34:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 20 KB
20 KB 16ms
13ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e162e82958f0afb7bd30d631c04a4f47d0693f931e7d44fa4c7c6c0a872b7f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 20502
expires: Tue, 02 Jan 2024 07:03:40 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 9 KB
9 KB 16ms
14ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fc29c04e8b33070a80736c06eb809f1077831e2d8799b52bb49ca4737930abb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 9343
expires: Sat, 14 Dec 2024 09:48:03 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 8 KB
9 KB 16ms
14ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

b22e1a648010a46f0e94a3c9e766c826383499b542d5bf05284ca911a24b2ecd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 8518
expires: Tue, 02 Jan 2024 20:34:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 13 KB
14 KB 16ms
15ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

2d185eb744e6c3b5a96ad5059e97a0dd5faa6762a4b348c3a928d2e465715b22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 13706
expires: Wed, 27 Dec 2023 16:22:49 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 158 KB
159 KB 17ms
16ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

d0ec4741d4baf0ffcb2705890339a373cf5e4939a632ebfb63aacc00ddb46894

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 162204
expires: Sun, 08 Dec 2024 16:06:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 99 KB
99 KB 16ms
16ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

786115da818c5a80e1d6959c0a191267ca7b84f71435a20508537aabeb4612a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 101104
expires: Sun, 08 Dec 2024 16:03:04 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 10 KB
10 KB 15ms
14ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

328bb96999971ad6cf3fc46e8dcbbcf7acc33ebadda0995a28ec60de4acca7a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 10396
expires: Tue, 02 Jan 2024 07:28:53 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 9DE1 20 KB
20 KB 15ms
15ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e162e82958f0afb7bd30d631c04a4f47d0693f931e7d44fa4c7c6c0a872b7f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 20502
expires: Tue, 02 Jan 2024 07:03:40 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 27 KB
27 KB 15ms
15ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a386b4f34ae910a7c21be6bd3aae679d902eabb6bab61efc1777279887a22a76

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 27584
expires: Fri, 29 Dec 2023 16:20:56 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 19 KB
20 KB 16ms
16ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

cc6cee8a781483bd64e735ba3a468e3eec78501f14000430305c07921e4c0503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 19834
expires: Sun, 31 Dec 2023 18:10:07 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 18 KB
19 KB 17ms
17ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

ef729bb645f2e2604a1e423bd1ce33a23905815679b29ae8f3a37971170a8032

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:08 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 18864
expires: Fri, 29 Dec 2023 06:52:10 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 15 KB
15 KB 17ms
17ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

6c79dc95481593b76c941133ebae36f18960a9017a4be5046de282aec271836d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 15058
expires: Wed, 03 Jan 2024 06:48:57 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 13 KB
13 KB 17ms
17ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

33101326f608f4024f1d1b452628a439dc86a6e8031cb4331de511d0c1a4a484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 13018
expires: Sat, 30 Dec 2023 12:57:47 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 16 KB
17 KB 17ms
17ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

f7c73f48c83f29d6b257a259d8e634740f4bc0ca6f872497f96341eb4c9e7183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 16846
expires: Fri, 29 Dec 2023 13:36:24 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 9 KB
9 KB 17ms
16ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

3c74245512a97cf63d9856d6b2d48b55c8738d4a88eb5856fd0247faa7bd04aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 9254
expires: Fri, 29 Dec 2023 16:27:32 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 7D40 25 KB
25 KB 17ms
16ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7391010b1ea7ea1de4acfdf41204af9191023ff870d522b400b1a988ab4ac608

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=604800
timing-allow-origin: *
content-length: 25596
expires: Fri, 29 Dec 2023 07:39:48 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/ Frame F6AD 31 KB
12 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231207/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BicO8vXaWSH9nebinLksdi_dYMx0zneJ6qDg3xwnAoJ0RDb0vs4uarAV01FyKvqispkKSgqIM-kTb2UasFPk_PAw126UrgDX8WrL1NYYnalPeIITT78j2YCYRFoipnuzjsUraeaMW1s-bafuWS1hA1p9Hi12bDLcsgKYWgqCOsa5m1EX8&cry=1&dbm_d=AKAmf-AhXe8G36JvWAPf0Nu2WYGDbADEW2_Tlg7qHsY34gRe6CLa3LUiCYuJFaAT1-11isyV42aXOY59kQ4azSjxKt4Asa-eoClcznjfcFAIyFgQX_5ZNiNAb2V3peUE9S3k-zjmtslaxDG0TYrBE66YVYZG8SBy2qcMhuIoL87J9Tm_oPaw3URzFFyprvuV-CYVdJPYGRyDyxx7zahY5HshaEz3Q-2_EBTZFT7zR7QfxAPT1ijhNQ3hArJF-sk_dSDJ1zfEBJv5LIlg8Dwlrh_yDPkmORKX2ivUXkocVD7jX-vQLSmtxJ7NYR-6riSfGSgUL0QeNkKRc6SzMLWmKzKcMJz5EQ8hzZ4PqdQ8hoVzpiuQvcmOXK5WtgXMPsLE07xrVNv74n5VxzCqZ61EUQa2gQBftII_T7aW-YhQnGPgr_a6_9xPSVlPYUXM7Wg9ATnoKq2MmVUhI79xqNVm64WNS8Hpd5W3fg-E1Y0Lc6v_xAz7m5A3zwVRpxI75JwoittxqvIcwolseu8PJx9dczRxwZtTUjFGiJy0Ud5g8A64csOqgteBk83VxgQ5YKiiES-Jm1bLS2HLP5BcQ6wt86un0FxQODcojgpCiGx1hdrX1K-wjulY3LDadepVhsMEJjn_uiurqBj54Erz0yoy7FkOe6irKAhTGX7c_UEknxQ5APGZ9NzNKw6ioZPSyU_CMtTwuGFSL5UX7mnQDk0U6HwN4EICuZJND0kxT1vRyWpb5gc6rgwQkc9zUXdixIQ38CMf3wcTyj2QyYAkofcFrSFA0AnA8d7GoS3RX3jCZU8umaxJAq-CEMvtQSAlXU4WCaZWkrQQ-kjgo958b5Vg2oYB3PZbGC7WLG5r3AqKjiUlP5E_WgJApg34tJ41TVlTCZ1MxWCeCvGpwf-mZSJVnl0mnYpV8k9E3_sLERPJCa7BzZlgdgsOen6kD3Vy9QXnYKob-5lCOuDHgPztDNQg5lJSOaDm2abK9BRuQmlkepPmZE0F5est6b6L59fw2jOnbW_n5E4fxzZx3M50x8tCCd05agVkUsxr2BreSxThQMCQqS5IVGKXOy6eVlIJqcGMRwIWOYMi0WNna993LvTqzJe32rvvbJwigKxqaq4Yjq5nqykmedkLQG2Mv6nuVH8_WHsMv3oZjyUBslGFPtlvFzdNxTM5McA7TnoPn41CKU65IYYLGxeH6XOEDG2IGCQsuTPucREsWggh7ux4YREb6kPeLJDOvULGRyyf0vizW5G7mt4xIeF6P3-cGzF0MNr8fyisgzoIXvClrYlrk8NXyMLTYArnnGAN5LfwqofS5HF0DIjIfEtxlIGptJEXcHRNqcrpBeRQ8HskkFW8O1mvnrUrzOuLJ-DVd7SeDeDA5GiZtpbgnG_ny97xwgibR--oNFDcypcQhguHYslLDxIFcV682I1Bx5KJvwFbY8M7YrvjMNgQ1sVcSGbnMFub4YwvjnYe4CVMw0y3eAwI4GCdfheD-1KArZ2Xmz-islyR6UB_wR55-clVAQgjGw5uW1fJI88xRAFxGtGWaFN5A-y4XzC9NEcxKHbvClnvRv6FLq7ascA387hH9qJq6abzIBt6ucNTiR0QVKIYGLyqLqjuPdeQdk9Gh7Bu0mQyhqfijwtmpGi9a0cvwwvyZqdHHvOxQ99XStU-w5w10hPdKkdPkgikyOl-W-Ax3BCYL2xpEiPajhT5Pp-YkLvqlmB-oNnN3O-m9OpSIlsdcJrYdhTBof_0XQ0TH-q2Mdg6xvsrilvKvVKXEhLd6G23Ft6cr5YPwv3IKbFOzObWUxrwHMdkj5QWQUpJ2LGKuRsIvFCIeOsgHuJV2AoSyZYTDiB45hQVrbK9utXoW2C38_qbChxhkK2AqXtvKG2CBAucU6IrpUSItbt108DjZy6z3lX2fqoLAJh0Za0LPs00FqXCbsEWKEcXe3jIdTxxoj9vMnwN-AdZ19MCdAsS2V9a46Mi0U5mUYy4TFSXwT4e6SWGFuoQWFDPfvNu_QGYAAJ2koRxohLly9Pe1V22OvTzTognSoW5M2u1i4ZhgEAP8hOQFrMWtZGZMRo3YpAJ21yx6m_mtsVQDjT5ygf_0BwRk68hMzxuHUx9Got0ijq64Jx824EyC9NXk_L4cqPlpNXbe5rz1L4J7ujzgVTsAgsmaB0M5EBXFoFC_jOzTX3B8R4bR5KsbaRizQCC02N3nIN9ieCyLXEzeQQhaDeLNvWtqZBJDoSi07FoT33WQzoPznHsv78WOY8XevW0kX4DYkyJP5Don_qLOadYT9Kx5oU2RzwufLRVks21dYaYDI7mnJHpqrxicCtChUk3RrRBhu23-25Drpzl5sclAvTeKncaqMS8_U9LB135LY1kXgLBjeFE4nSbMXuffngOIRtc8qqXwaL2Q2Op1AKzAyl6uYdTIqxDOSSUPZUegQiQK_nsqkR45Asd0k8TGvh_bt3G075SV6qZkjl7s991B2AZRsPvJTspnRqwAQNV3V2aqrtDjV92T4zEWmadtpCjmwEKQQGgxUl0WQm3splyeUQFJr-n6XUquYDYbdFvy_HUzDel_OeQYC1kVprgwQXXQKMBinsavswlsVQtQXZHSlML1jO7skzUmOKYiIUpGqpOkwzJXqBkb322ZHA4aAe7n_l76w9ZIYR1OlexlRrF8gp8vJl_JvAkG4NKiYh90DOPsW_VWfwIOcb4ojidR74YuidAhUU0XZ9t5TCBbB4zdmriuToYzx6o_YR5JmyyWjUIdQdFnVRVX5SDcPyv0B0hVgUdg8D1kOwWMnGlVyeMk_JLhzBjrpiQ3F17mL6f_w2Xm5jFLYlspR_DSa8OJQSnLZncpTbJdxHmrqKruhnDjMckS4NfQIJuub7y5kNSeC_Alqrt97OFBU9R5bdpCB6P5m89WK41d_uabOfmX9ac32gLhFcLHQdgstqwUgjPt-VY3yZLlhIa7Sq9uzvTlLpTBHuwmPgKWabGsF222tGQq2BEKjvtGpiQijPKTEoo16fZKEsnpwutELW17cnSoUz_A9cIvJCfcgrAdrSz1JhteXaxIkUfrVLMjMhEt2cJajyI68jN6t1gclCLRfx53NmC5GOVQLhcezOLYYf9gFiLEkQ5zBWEz_mKR49NmNM-RPVO1IMxitvuAh-sIGoa2_ocPuY8Vu5s5EyGAwHVfWclGVM3ZgTEqZheQg00qE6WSpYn7a6t4jaC_GGy4ex2iVNnmAT3h4WkwgrH5AYwvrNCn4jTYtJsovc3e1dC4ghFqWqL1KUdTmNxPQvB97I95vXEfXdT0nMp0a7n6nwYWYze35INJoxl8LjW-MnIv3o1K8fWhBJg2KnZNIeStxycm03S0ynaHkv0ySxb5PJ7kizCrnvP2zqAdUql2bhS3J3HqwDIixwGK4aCG-LHli6Xk212JmX7JHF7iuDWwfIoGcl2DUsdxP8YJFzNnsIpzV5C8YbRUDo3yQIirlT3h4ciGTS_yp3IXoq0ZA2Pcj_x39FHyEasErNtK_mnYZReDUrMgNpvfZGS76upNOE3RhqEE4voqk4Kkd2lPiriDcT4VezU5vlE2FGQimrt8WwN9k-Y6nAHvwV-sUmvJO7b2oR0iGE8VzDNIZt_FP-bzf8fMoEhuUuEVLmGz6I-j5Zmr5s64CbxoZL1HqQoEZ3jCIkaE39oTiXCDf9AXG2FbBvAsZTS17XGmIQt-6sO6Z31dfj_GRMhyRRzNYV3VxoEzUOkIGb9aN8x0TBWzHy1GDiCE75lf5mYoTEu2vvWjtToKOCwXA3oyh_nRLDfpxkvgEMJrbFBZ3tjrg&cid=CAQSOwAvHhf_-UC5edhqfpTtDBXNWFZCwLwrlvGuo3o98_wcgxU_jtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2F&ds=l&xdt=1&iif=1&cor=12719247477613752000&adk=521587873&idt=114&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

565592ede82822decb298ebd1e6f56e9c6a680b1a79cd4208513a834295e4c43

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 20:42:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55722
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11872
x-xss-protection: 0
server: cafe
etag: 16225921609732785849
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 09 Jan 2024 20:42:27 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F6AD 41 KB
14 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Tue, 26 Dec 2023 13:49:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80513
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 Dec 2024 13:49:16 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMzY3OTA2OTY3OTc1NQogIHNlcnZlcl9pcDogMTM5ODAwNTQ2CiAgcHJvY2Vzc19pZDogMjE2NDM1NzkzNAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMjYyNDc1...
ad.doubleclick.net/ddm/activity/ Frame F6AD 0
22 B 47ms
46ms Image
image/png 142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMzY3OTA2OTY3OTc1NQogIHNlcnZlcl9pcDogMTM5ODAwNTQ2CiAgcHJvY2Vzc19pZDogMjE2NDM1NzkzNAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMjYyNDc1MgphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vZml0bmVzc2ZpcnN0LmRlIgp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDEyNDEyMDc4MDczOTU0NjMzNDE0CmRlYnVnX2tleTogOTk3NjQ4NjEwOTE1MTE5Mzc1MgppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTItMjciCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMjYyNDc1MgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDM4NDIyMzk4NQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTA5NzgxMDE1MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyMDg4MDkxOTg2OAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDU0MTExMDMzNwogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9maXRuZXNzZmlyc3QuZGUiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9kZWJ1Z2NvbnZlcnNpb25kb21haW4xLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2RlYnVnY29udmVyc2lvbmRvbWFpbjIuY29tIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xf939c9eb0ce9f3990000000000000000","13":"0x8dc2cd6f928ce8830000000000000000","14":"0x6ed72b5514ff9a350000000000000000","15":"0xf06d34030a2aeea20000000000000000"},"debug_key":"9976486109151193752","debug_reporting":true,"destination":"https://fitnessfirst.de","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["12624752"]},"priority":"0","source_event_id":"12412078073954633414"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 banner Show response
ad4.adfarm1.adition.com/ Frame F6AD 6 KB
3 KB 16ms
15ms Script
text/javascript 217.79.188.46
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad4.adfarm1.adition.com/banner?sid=5158022&adjsver=3&fvers=&iframe=1&ref=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&ro=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/120.0.6099.109%20Safari/537.36&os=17&browser=11&userid=0&wi=1964868151&ac=1&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3D
Requested by: Host: ad4.adfarm1.adition.com
URL: https://ad4.adfarm1.adition.com/js?wp_id=5158022&clickurl=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs-IChABIJKygg5glaqzgsAHoAH39-mEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk_Qgdz2uCTDlJO9apu4qa-G4TLTv-D9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6_xTF9iT3U5M0v5IaXABVnLzg_iYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv-TXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI-JZJIwSwNJDxs9SajHH24-PdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB_evuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY-MfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G-ihbQEwDYEw2IFALYFAHQFQH4FgGAFwE&ae=1&num=1&cid=CAQSOwAvHhf_-UC5edhqfpTtDBXNWFZCwLwrlvGuo3o98_wcgxU_jtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE&sig=AOD64_2jlVGqxbLIGWVAvCqWlrvIQwR4GQ&client=ca-pub-1784742484268469&dbm_c=AKAmf-ASTp4OqI6Pgt9_TyWTlISKbGk35-bI7w12joiQ4sCKTI7_cTZFhfq23P3otNXQ-8qTascNhA-4zTgI6DV4m57okvYadFUsZ3wem2XWf_xBQAZ9Gmw51VCPYQLxml9xB-scR8gr1yMYpcGtBFfGOjgBRW0_CoMp6JETaChgPSjv1raI0xk&cry=1&dbm_d=AKAmf-BOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs_HRVlKL5Ik_zcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl_u4Ikvqin0-6gXuQl1WSKrDUiSUZMid2OGT-aqL8Ock3cHGAOI9U0oy-5IY0XrCFHP4mbjVGffCKU5HuYLr_de2T32XGGhRUtFHmMV3-SaYNAmFQNNWA5KuyH6TI1IRycpKhCySf-5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57_wVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ_dNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4-hCL0RZfeFqSX_DYp4Hg-SvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.46 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad4.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: 2e91ba8f4bcdaf31af0f6031cdf57256d70ab6f6014784f54e02f558aa124de1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 13:11:09 +0100
content-encoding: gzip
server: ADITIONSERVER v1.0
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
content-type: text/javascript
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame DCA2 23 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 89804
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 7799
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 11:14:25 GMT
expires: Wed, 25 Dec 2024 11:14:25 GMT
last-modified: Sun, 25 Jun 2023 02:58:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 331D 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 10:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179747
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Dec 2024 10:15:22 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 18E1 0
24 B 47ms
46ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BoQa5XRSMZZ5J1oLU8g_PwZuoAwAAAAA4AeAEAg&bg=!U1ClUB_NAAY3kmNgF5I7ADQBe5WfOOewuWGw0EOFd8jqUOz_x-DDp7prSz_h-H74n_gWmAJv83VJMt5AAqsMvdd86j9QAgAAAVtSAAAAA2gBB5kDRpfESSJbs7Sdh-sCFM58Avl7qkf2mh2uS4mqMwGxvaeXZ0xcTK-79SwQOCWx1D7I2NPA8UY5XWjpBy7ZhR7_goJAdaSgPrHXDwwRBBvbhfyQDoHF-NbSF_kbAW7sSZiaxnUeTUMFW_dR16bAhTLzFn-VH-PCp30gspYHi0KT-1wXj2gDV9os5mIE6fxwOIQMa8Pwjl7EQaX6p7yUsUzWvuRBw96ITgAOoabrVbpnIOCdwdkooPASPtN3DoiCtNTkTPQZkcBcBZ_tIppOxTkiK3_VQzaHERlptcmOWusB3sJsXCgI9d1yAzWRepYBxwakzRZuYivYJDd4yi5hCtlyFud2iU4ZrKOfkPC4v0-7Y5d-nSkPx8mCOaoYQCPENeFqHbZjqp-6FGXN-uam_ClckzxslMdXfRPJz1iWjxXH8sLwSTgnlFLoECQFke29VL9k4K2g1w_IzFj1mhqNvW5J5jHoa1meTwbgqPpSf5Y3TbXN-YpGW9VFza1Se6au9v8SoWh4VqUkzh7OcrWblA5ctbzFuu9AapMxE3k2uIqYP0m8nM2qEwL2cQ9Mze4jPhgDZDXMQs9Q80Wvx8asKdHzYKak1QPutQza9WAHbYg8_CZA438GNHQYz_mrfGdozqw2xg_FASbb1U_J0upqyTqx44xrif7aeWMMMj4MQWHwJCNia6FD7E-bNoPvMMhVCBQ5_8rST898mKCRUpwKUaMCLJjYPP1HkooZi9QXvxeTuKlw8KJZCPjrkfGoj7zOLDx3OmwmKR76eAh7GX2bQsJEe6JWiTya0gFs7Ucng-ZTqpS5GbpwPPjQym7bEH9GJfc4x5-j2cAxbvwGZ-4I6ulMqUqLQs0jtRy3dfwnHe8W2QCmrSaniNa6zmvvEteMP5jn2hyA9g4F2gdcWvnn587u0RHpEL65x0nlAHQEN-zjC7NsQrJqCNPS6kq5g9R9OW0ISTq0s9vnhFjMaOod2wY9vkXateQQNgGsZ5vyoz5WAN39O2qL5iUqROHJHwIIRvrJ7bUhkhNDnb5acDR2TXr50H9lrsQiYhE6k_2tNG9LO6kzdpBkc5MZGhnM8-bW4353jQ7BOa1hlvqTiLaHn1iY6y9DfUrJDDA

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adition.js Show response
imagesrv.adition.com/js/ Frame F6AD 32 KB
8 KB 14ms
14ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adition.js
Requested by: Host: ad4.adfarm1.adition.com
URL: https://ad4.adfarm1.adition.com/banner?sid=5158022&adjsver=3&fvers=&iframe=1&ref=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&ro=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/120.0.6099.109%20Safari/537.36&os=17&browser=11&userid=0&wi=1964868151&ac=1&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 6356dca74d480f9fe67e7a08ad460f342880cfb3004f3ef6d8df6db39edae277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:09 GMT
content-encoding: br
last-modified: Wed, 22 Nov 2023 10:00:03 GMT
etag: "3305548861-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 8362

GET
H2 200 js Show response
ad2.adfarm1.adition.com/ Frame F6AD 4 KB
3 KB 63ms
22ms Script
application/x-javascript 217.79.188.21
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.adfarm1.adition.com/js?wp_id=4847836&gdpr=0&gdpr_consent=&ts=7317245884263303948&kid=6274928&bid=19051307&keyword=PACS_5158022_19096888&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D
Requested by: Host: ad4.adfarm1.adition.com
URL: https://ad4.adfarm1.adition.com/banner?sid=5158022&adjsver=3&fvers=&iframe=1&ref=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&ro=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/120.0.6099.109%20Safari/537.36&os=17&browser=11&userid=0&wi=1964868151&ac=1&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.21 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad2.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: 4bdd021f858e6b75078726661e17104709f38fc6a035d9763d5c510d7f1b7f56

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Wed, 27 Dec 2023 13:11:10 +0100
cache-control: max-age=600
content-encoding: gzip
content-type: application/x-javascript
server: ADITIONSERVER v1.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 111E 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 78631
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 14:20:39 GMT
expires: Wed, 25 Dec 2024 14:20:39 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame DCA2 39 KB
15 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 10:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179748
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Dec 2024 10:15:22 GMT

GET
H3 206 file.mp4
r2---sn-4g5e6nzl.c.2mdn.net/videoplayback/id/32ca47640c8a13be/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3846240834/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 6883 2 MB
2 MB 22ms
7ms Media
video/mp4 2a00:1450:4001:3c::7
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:3c::7 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

a24e7b3830e2c5212d6ff52b7af0ea8b6d0bb85141bc9c5d9d4534b14bf87a65

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Range: bytes=0-

Response headers

expires: Wed, 27 Dec 2023 12:11:10 GMT
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-1715587/1715588
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 1715588
last-modified: Tue, 05 Dec 2023 16:11:35 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://googleads.g.doubleclick.net
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://googleads.g.doubleclick.net
client-protocol: quic

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
54 B 278ms
278ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=6~lqnqj3jf&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=2076&mt=video%2Fmp4&vs=1024x576&ple=1&umsem=0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fvast.doubleverify.com%252Fv3%252Fvast%253F_media%253D3%2526ctx%253D10242044%2526cmp%253D30443038%2526sid%253D5513185%2526plc%253D380567266%2526adsrv%253D166%2526_redirect%253D1%2526psf%253D0%2526_vast%253Dhttps%253A%252F%252Fad.doubleclick.net%252Fddm%252Fpfadx%252FN7657.3553448DISPLAYVIDEO360%252FB30443038.380567266%25253Bsz%25253D0x0%25253Bord%25253D%25255Btimestamp%25255D%25253Bdc_lat%25253D%25253Bdc_rdid%25253D%25253Btag_for_child_directed_treatment%25253D%25253Btfua%25253D%25253Bdcmt%25253Dtext%252Fxml%25253Bdc_sdkv%25253Dh.0.0.0%25253Bdc_osd%25253D2%25253Bdc_frm%25253D2%25253Bdc_sdr%25253D1%25253Bdc_ref%25253Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%25253Bnel%25253D0%25253Fves%25253DdGltZXN0YW1wOiAxNzAzNjc5MDY5NDkzCmNsaWNrX3Rocm91Z2hfdXJsOiAiaHR0cHM6Ly9hZGNsaWNrLmcuZG91YmxlY2xpY2submV0L3Bjcy9jbGljaz94YWk9QUtBT2pzdXNTMWJYWXh0dTl1ZUREdWVDcHprMlZnU0xPNkczYm1wbzFJdkozME44b3BHX3ZsaGlCUkZvSWtFdTl5ZFlQM0Zqb09IQW91T1ZTS2R5QzBwODIwbElaRmNfRFZUZGw2aURrcUI2a09CVjZMNVpORG14ZFllc1V3Y3kxVHRhR2tZQVNrZFEtXzVWUFRnTlRmYm5uTkRpTDZvSnk0T0s4UWNrQThZN1FVLWh1UmVOczZua3FzNG9sRmNFRDNxSVFMTjdLSFN5MFhuNVB3aTFfZXpqQmRCYURMQ2FuejFZZlY1bHdfQ01sNEtaNXhCUTMzb1JfYmJrVEVRWHRyZi1BZ3NTN2I5NHRLTy02WXRyRWUwWDk5d3NuamRrNkhIZTgzWHllVHZDanowRGtuTlRrZzdibGlacVpUbzhhUXhGY3hWTWVYdHN4Y2lHdDZFbVJLaFZ6ZHRTM0d5Qk5GOUgtZWEyaU1NODAyVWpvTXdCbFNxODd6SWJIdWxLYmZqX09OdnVyeHBpbjhoZ0p2ZHB6LTlsblpjTG1OU2prSkI0OXZaNWhWUzYwdEdkbGlJM3A3cHp5QXU2eEJReExEWEVzcENUMy1vU0VFTFVyWDMwSmxSNkdmUmdBSXoycjltOTRvSFdpZnVuUnhZcTdmUFJ5RXo3X0R0anEtQ1VVNG1aZUhXVzVsX1V2ME9TdTdXWVJGem8zMU5aNmpFMDdBLVlhSl9JWjJKV3JEQkcwVGkya0hWYWw5UmpDZ0tGajVQV3BmQTNzVkhXSUFzLU5tRlczOG9FbURvVmNYUExtdnNWa3RQdTNPU1RxR2tCSHlBRy0weVpQNm5PRTJab3FvQjFkSm52NmQxVTJNMU5fc1M3MzVQNjVqOC10Wm9LWjVTbkgzNXdCc1cwNzhEOGVmSEc5LTZyUnFYeEMxTlpZTGFSVGxnR1VwWENQOW5DTnlxNGVpdW1mNFlxRWNBMEpSWVZzM0V0dVdrUXBRbHotZnJMclZfRFVmN05vdE02R2ROZmJVMWphd3FOdm95R19acE1XMW9vWnFLejNRYVN5S0RRYmJlVXlNbkZYVUNvT2dUd1dKVVp4TmNDcmxMNllMVFpMbk5IRVFuXzZYejNwOFZFeFI0YUM1alM4RktSdDdQX1RRbU5mdWxBa3FZWmpNMm9xZC1Wcmh3Mm1fWTRzMmsyMUs3cnpvNU41VXZXd1lhUmotRTBnR3VBSHNlM2xpRDh4eVhnaUdCV0dKeFJEWXF6a1A0TmhhQUZHZk1KWDJ0Wll1ZjlmR1Z2b1NYRWtCVXVlaW9ZaW8tbldqeF9tSnlBQl9CS1p6YS15SHJFZ29YNlFEcHJTbFhKNXBLVllvWUZ1Z2VJNnQzVncyMUVFMzU5dXBnMy1LTkF0M19STjJWWUhEdGVseURSM2FfOTZjWXp2Vm9JLTdZM3l3d1VONnF1Q1ZpcWlseVlRdlAxSlFrM2JrVlBDWVJsZVBzbWh4NzEzRGMzY09tTTBHMTVKZ1p3LTktUjJLZUYxZkVZbTdsLXpMS1pYVS1SZ3lLM3JnOUpLM1FSMm1VWHBMVzNkcnBadWVkNHBLRVl1TmY5RTZTQkszbHVJNGpDQXh1ZFBmSDBzNVRnLWZjVXJ0cXkwYzdfcXAyS1E0VW1hSklUS0duZFUzNmszcmVidjJFOFZ1Z1Y0dUItRlRpaUZnWXVQblF1WUFsbk12cHZGdDN1WGlHQTFPY242Nk5TSFQxblZuY1RKek5ZLW16LUhNZDhQbWdiQ2ZWYkhZQW1zNXl3OHRZUjF6RTRZeU5jTnNVbGpfbm9WRWN1eVV0NHRNSSZzYWk9QU1mbC1ZU2ZoNFBzZVFaclZuZUhBYld4MC0yMTBDVEdhVjhzZDhGR2dXMTdlcUpPZmdtUldpWTN3TS1uejBkTURSUTkzQ2tVZEtBUUlxMHdZQ1VFX1JnTDJrY1BYWkNxaHdtaGhBMGFKS09NWDZ1Q19XRzJLaDBMZnJEMnlVcjhaMVlBOGdpb21XMjdRY0dIYldXWWhzZlZscXFKQkZXNXFkX2N3dkZSdUg0Yk9QS1VjTHQ5ZG5PSWh3WWkzUGgtaERxZ3p2ZE5yZzI5dGJmM0xyWE5mZExLcFJrblJmM3Vmc0d5NTlYMTFBV280dmdyOWxDTUVmWXRWQ2k3UmNvanZ1X2tlS0trVUY2V0JLdlFqMjF1SkRKUHlZaUZ2WEp2dGpVTTFHdHYtRWdiLURCbzhTXzZWa2Mmc2lnPUNnMEFyS0pTeklNRDdLVl9jZTNZRUFFJmNyeT0xJmZic19hZWlkPSU1Qmd3X2Zic2FlaWQlNUQmdXJsZml4PTEmYWR1cmw9aHR0cHM6Ly93d3cuZWEuY29tL2dhbWVzL2VhLXNwb3J0cy1mYy9mYy0yNC9mZWF0dXJlcyUzRnV0bV9jYW1wYWlnbiUzREZDX2JyZF93d19tNl9wcmdtdl9kdjM2MF9tZiUyNnV0bV9zb3VyY2UlM0RkdjM2MCUyNnV0bV9tZWRpdW0lM0R2aWRlbyUyNmNpZCUzRDczNTk4JTI2dHMlM0QxNjUyODkwMTQxNTkzJTI2ZGNsaWQlM0QlMjVlZGNsaWQhIgo%252526dc_cid%25253D206729091%252526dc_adid%25253D572283934%2526_api%253D%255BAPIFRAMEWORKS%255D%2526_ssm%253D%255BSERVERSIDE%255D%2526_tsm%253D%255BTIMESTAMP%255D%2526gdpr%253D%2526gdpr_consent%253D%2526_abm%253D%255BAPPBUNDLE%255D%2526_pum%253D%255BPAGEURL%255D&encoded_body_size=0&transfer_size=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 111E 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 10:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179748
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Dec 2024 10:15:22 GMT

GET
H2 200 banner Show response
ad2.adfarm1.adition.com/ Frame F6AD 10 KB
4 KB 16ms
15ms Script
text/javascript 217.79.188.21
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad2.adfarm1.adition.com/banner?sid=4847836&adjsver=3&fvers=&iframe=1&ref=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&ro=https%3A//googleads.g.doubleclick.net/pagead/ads%3Fclient%3Dca-pub-1784742484268469%26output%3Dhtml%26h%3D90%26adk%3D2743202993%26adf%3D54630664%26pi%3Dt.aa%7Ea.772858473%7Erp.1%26w%3D1200%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1657202602%26rafmt%3D1%26to%3Dqs%26pwprc%3D8995255381%26format%3D1200x90%26url%3Dhttps%253A%252F%252Fxn----7sbdfpa2ceibrhv.com%252Frabotno-vreme-jumbo.html%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1703679068946%26bpp%3D1%26bdt%3D1957%26idt%3D1%26shv%3Dr20231207%26mjsv%3Dm202312070101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26cookie%3DID%253D5c2becede107c8c9%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew%26gpic%3DUID%253D00000ce8bcaab7f0%253AT%253D1703679067%253ART%253D1703679067%253AS%253DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ%26prev_fmts%3D1200x280%252C728x90%252C336x280%252C0x0%252C1200x280%26nras%3D3%26correlator%3D797003850337%26frm%3D20%26pv%3D1%26ga_vid%3D1939296449.1703679067%26ga_sid%3D1703679067%26ga_hid%3D1529806403%26ga_fc%3D0%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D200%26ady%3D3643%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759876%252C44759927%252C44759837%252C31079979%252C42531705%252C95320870%252C95320885%26oid%3D2%26psts%3DAOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%252CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw%26pvsid%3D3570524922569749%26tmod%3D1249513866%26uas%3D0%26nvt%3D1%26fc%3D896%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D6%26uci%3Da%216%26btvi%3D2%26fsb%3D1%26dtd%3D8&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/120.0.6099.109%20Safari/537.36&os=17&browser=11&userid=7317245884248951818&kid=6274928&bid=19051307&kw=PACS%5F5158022%5F19096888&gdpr=0&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D
Requested by: Host: ad2.adfarm1.adition.com
URL: https://ad2.adfarm1.adition.com/js?wp_id=4847836&gdpr=0&gdpr_consent=&ts=7317245884263303948&kid=6274928&bid=19051307&keyword=PACS_5158022_19096888&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.21 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad2.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: 7acd86bae83f1eb08979b1d3c9a8195e9cf67846dd82655870aec98ade5c54f8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 13:11:10 +0100
content-encoding: gzip
server: ADITIONSERVER v1.0
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
content-type: text/javascript
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 dc_oe=ChMI3uvgjcuvgwMVVgFVCB3P4AY1EAAYACCnrothQhMIr97-jMuvgwMVKGoVCB35MAsx;dc_eps=AHas8cBXyFe-AM3i3zg4pDt3zd0cO483mS_djN6NuNLfECPkVr3gGGhZlIMKOfqZrrwWPJvDYkGZMrw;met=1;&timestamp=1703679070108;eid1...
ade.googlesyndication.com/ddm/activity/ Frame E7E6 42 B
401 B 78ms
48ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI3uvgjcuvgwMVVgFVCB3P4AY1EAAYACCnrothQhMIr97-jMuvgwMVKGoVCB35MAsx;dc_eps=AHas8cBXyFe-AM3i3zg4pDt3zd0cO483mS_djN6NuNLfECPkVr3gGGhZlIMKOfqZrrwWPJvDYkGZMrw;met=1;&timestamp=1703679070108;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
imagesrv.adition.com/banners/268/01/22/b3/2b/ Frame 6863 6 KB
1 KB 29ms
27ms Document
text/html 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Requested by: Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: fb93dd5ff3cb9d25e69a8abcfc513c3a172e81d5e8aecbe48ca60c7edadd323f

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
content-encoding: br
content-length: 1107
content-type: text/html
date: Wed, 27 Dec 2023 12:11:10 GMT
etag: "213197050-br"
last-modified: Wed, 13 Dec 2023 10:53:12 GMT
vary: Accept-Encoding

GET
H2 200 oba_priv.sjs Show response
imagesrv.adition.com/banners/270/ Frame F6AD 2 KB
692 B 29ms
27ms Script
text/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/270/oba_priv.sjs?oba=&domId=obaButton_7317245884263303948&btr=true&pos=top-right&cid=34720&aid=34720
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 6aa498d0304c9714b020e7a097afd091188fd42b9b093c3561bab5dc892392b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
content-length: 609
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0890 1 KB
647 B 11ms
10ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 55876
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 26 Dec 2023 20:39:54 GMT
etag: 48472445140208031
expires: Wed, 27 Dec 2023 20:39:54 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame F6AD 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f31d29353966c8987283a607a049532ce746a10574eafce5e59e1c93523d203b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 AditionH5_ClickTags.js Show response
imagesrv.adition.com/js/ Frame 6863 753 B
410 B 14ms
13ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/AditionH5_ClickTags.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5a0cecf509251de7b796c7c34ca1374bbb3fabe582e9e9394f1a1ebd9d421997

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
last-modified: Wed, 22 Nov 2023 10:01:14 GMT
etag: "597418985-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 330

GET
H2 200 stylesheet.min.css
imagesrv.adition.com/banners/268/01/22/b3/2b/css/ Frame 6863 7 KB
2 KB 13ms
12ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/css/stylesheet.min.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 1dbaba3122fc7599fe6851abcbb6e1eb739206a71b011b733cae24665417c6cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
last-modified: Wed, 13 Dec 2023 09:14:48 GMT
etag: "1801411924-br"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
accept-ranges: bytes
content-length: 1666

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.6.1/ Frame 6863 61 KB
22 KB 18ms
17ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.6.1/gsap.min.js

Requested by

Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dce03f3336254bd93ae523da00dc35de7a9851eb33fb6fbe20d94d4d32612a2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 2350871
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 22334
last-modified: Thu, 25 Mar 2021 07:56:19 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "605c4223-f455"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BrPr60snJUT8PieqlDqB6MTZFQpttQQMtpwDNGhpEwRZC4zvlCazP76T%2BLTlAFHTDmbF6g8owpDIt587m%2BYKXtPE8r2xt3LXqquVusIIJYPWlogpb4SYhtxJXrJJeHRdubl1L27p%2Bjw%2BL72t1%2FoT62yR"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 83c176ecbf5137d4-FRA
expires: Mon, 16 Dec 2024 12:11:10 GMT

GET
H2 200 bg_1.jpg
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 11 KB
11 KB 14ms
13ms Image
image/jpeg 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/bg_1.jpg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 056305055f015535a540662c43cd3ae90f419165efd4d04bf23d66db1f66254d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 13 Dec 2023 09:02:23 GMT
accept-ranges: bytes
etag: "3453116650"
content-length: 10889
content-type: image/jpeg

GET
H2 200 logo.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 1 KB
1 KB 14ms
14ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/logo.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 37ebf9414a9561684f64f1664123e1e6c4b3ba68cf8d3ed2753f8022c8893cc2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 09 Oct 2023 07:47:31 GMT
accept-ranges: bytes
etag: "3272734176"
content-length: 1330
content-type: image/png

GET
H2 200 m_1.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 47 KB
48 KB 14ms
13ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/m_1.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 36fef9e80aa0fd980df7fcac8e0283632e986a75a20e9bdf2992cb48e18d6460

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 13 Dec 2023 09:02:22 GMT
accept-ranges: bytes
etag: "1502588344"
content-length: 48590
content-type: image/png

GET
H2 200 txt_2_1.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 1 KB
1 KB 14ms
14ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_2_1.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 95b79d7686bed4352e20317ec786f52255542816dde5719099d8c49a5641daee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 13 Dec 2023 09:02:23 GMT
accept-ranges: bytes
etag: "3191989463"
content-length: 1082
content-type: image/png

GET
H2 200 txt_2_2.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 654 B
706 B 14ms
13ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_2_2.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 1f3ba10c006d3565496f0133947f553332ef4bb9c37665249f5499229914c00f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 13 Dec 2023 09:02:23 GMT
accept-ranges: bytes
etag: "3587203872"
content-length: 654
content-type: image/png

GET
H2 200 txt_2_3.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 1 KB
1 KB 68ms
67ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_2_3.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 4aafa7828cccb0892b3c1ed6a482a8e5f7459676c41bbababf3674b3f2fab954

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 13 Dec 2023 09:02:23 GMT
accept-ranges: bytes
etag: "3937002116"
content-length: 1215
content-type: image/png

GET
H2 200 txt_2_4.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 953 B
1005 B 65ms
56ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_2_4.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 82cfe4f57246b953b23816190a621079591c1b579504b7df9a75d447d9083c1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 13 Dec 2023 09:02:23 GMT
accept-ranges: bytes
etag: "2825398069"
content-length: 953
content-type: image/png

GET
H2 200 cta__bg.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 285 B
360 B 65ms
55ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/cta__bg.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 54f0b27a723ecb93512f8f1f311cfaba2d469227a68935e3394967c6bc85c89b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 09 Oct 2023 07:47:31 GMT
accept-ranges: bytes
etag: "1618539483"
content-length: 285
content-type: image/png

GET
H2 200 cta__txt.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 900 B
951 B 65ms
56ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/cta__txt.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 594ba6116aa117a6e4a1d3ab5d543c1a4b793f31c8b07fcfb32289a1c5f5f6bc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 09 Oct 2023 07:47:31 GMT
accept-ranges: bytes
etag: "3390076610"
content-length: 900
content-type: image/png

GET
H2 200 cursor.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 457 B
533 B 64ms
55ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/cursor.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: d89af053267d4e7fd540efb1644477d56d03bdec78ee6ac865812b562a8fdde9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 09 Oct 2023 07:47:31 GMT
accept-ranges: bytes
etag: "1781069596"
content-length: 457
content-type: image/png

GET
H2 200 txt_0_1.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 2 KB
2 KB 63ms
54ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_0_1.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 4dca9505103298186cfb03478624f3fe01d5e24d3454d53b828490494fb7c2cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 16 Oct 2023 15:02:05 GMT
accept-ranges: bytes
etag: "1341849174"
content-length: 1751
content-type: image/png

GET
H2 200 txt_0_2.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 1 KB
1 KB 63ms
55ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_0_2.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: db0c0ef1f8f9232c1ba717389c458cec0d4b0b5410cbc4c41b7ebeb810ca4b04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 16 Oct 2023 15:02:05 GMT
accept-ranges: bytes
etag: "2513075711"
content-length: 1247
content-type: image/png

GET
H2 200 txt_0_3.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 3 KB
3 KB 77ms
13ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_0_3.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 1d1520bf4c4033f4cf099ffe5ad93de087af35d3462adcaadba07a9d46238253

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 16 Oct 2023 15:02:05 GMT
accept-ranges: bytes
etag: "4247813380"
content-length: 3266
content-type: image/png

GET
H2 200 txt_0_4--1.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 2 KB
2 KB 77ms
13ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_0_4--1.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: c21c884984d4b4289e9633df9b37b0da9b1443802d7beac3541c6765c853c5f7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 16 Oct 2023 14:54:11 GMT
accept-ranges: bytes
etag: "1304775356"
content-length: 1844
content-type: image/png

GET
H2 200 txt_0_4--2.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 2 KB
2 KB 76ms
13ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/txt_0_4--2.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 547f436ff9c28e5177ae31abf4f0a96d07ed3587f7eedc0249fddc987767cec9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 16 Oct 2023 14:54:11 GMT
accept-ranges: bytes
etag: "2530020748"
content-length: 1551
content-type: image/png

GET
H2 200 logo_x--1.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 4 KB
4 KB 76ms
14ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/logo_x--1.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 3e89dd8f43de31ba611483bf138b9b551092ba1a41124206862739245021b945

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 16 Oct 2023 15:02:05 GMT
accept-ranges: bytes
etag: "3254320420"
content-length: 3677
content-type: image/png

GET
H2 200 logo_x--2.png
imagesrv.adition.com/banners/268/01/22/b3/2b/img/ Frame 6863 3 KB
3 KB 77ms
14ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/img/logo_x--2.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: c5847d772e54b4295c003050e5e4085155286ecc9349452674e86c7b2dd05ab6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Mon, 16 Oct 2023 14:54:11 GMT
accept-ranges: bytes
etag: "465455488"
content-length: 2849
content-type: image/png

GET
H2 200 pvm.min.js Show response
imagesrv.adition.com/banners/268/01/22/b3/2b/js/ Frame 6863 15 KB
3 KB 14ms
12ms Script
application/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/js/pvm.min.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 1d402ebf6a2bcbd0d560377e6e8dd723e0baa8110be157a829a65f0aa3fe32f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/268/01/22/b3/2b/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCourqXRSMZdrrAubD5LcP2vWc0ArA8Nz0dIW4hfiQEve3vs%2DIChABIJKygg5glaqzgsAHoAH39%2DmEKcgBCakC7KsyHTOHsj6oAwHIA5sEqgSAAk%5FQgdz2uCTDlJO9apu4qa%2DG4TLTv%2DD9LHqdgFIcDNGDOgCJnKbAmzwh2E7w3E7OBE5D0FxLvmxE1ncH06eII2qWbDa6%5FxTF9iT3U5M0v5IaXABVnLzg%5FiYD5HPhACvrGe7CEXh5UIdTq7w33j7pvah72DMjmhr45464tUBlx5lcH3Gxq1GMcfew84Y06BYqe81SKfIQE4BBEeQ3xHv%2DTXYHQRtj9nnhalM7aWbQL9bRu5HgUgqylOzKczvVlzEA7AeEoYYottEXLqDAFC5v5zmeSk3tuOjYLusISKTudrXvUPI%2DJZJIwSwNJDxs9SajHH24%2DPdwymuV7md7fc1n0XLABJLM4I63BOAEA4gFvJrm5E2QBgGgBk2AB%5FevuuQDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH%5Fp6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH%5F56xAqgH35%2DxAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY%2DMfejcuvgwOACgGYCwHICwGADAGiDBAqDgoM5LSxAu61sQK1uLECqg0CREWwE4G%2DihbQEwDYEw2IFALYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSOwAvHhf%5F%2DUC5edhqfpTtDBXNWFZCwLwrlvGuo3o98%5FwcgxU%5FjtahWHNx7iS7WDZCVDddHDqtMLNs8EtjGAE%26sig%3DAOD64%5F2jlVGqxbLIGWVAvCqWlrvIQwR4GQ%26client%3Dca%2Dpub%2D1784742484268469%26dbm%5Fc%3DAKAmf%2DASTp4OqI6Pgt9%5FTyWTlISKbGk35%2DbI7w12joiQ4sCKTI7%5FcTZFhfq23P3otNXQ%2D8qTascNhA%2D4zTgI6DV4m57okvYadFUsZ3wem2XWf%5FxBQAZ9Gmw51VCPYQLxml9xB%2DscR8gr1yMYpcGtBFfGOjgBRW0%5FCoMp6JETaChgPSjv1raI0xk%26cry%3D1%26dbm%5Fd%3DAKAmf%2DBOjvaSQUAeMVxF2pHqL06izF34JAMPCYjleDqvEvnaRhRs%5FHRVlKL5Ik%5FzcuxVRV4Wpz3k1uD5PL6NB17zCsd8mc9nlHw2sa4gwvY2Rju3SphVaKvXOdtFIJlGr6w3nEGIAFMdp27GSE4bReFMxJVS1HCzAIsl%5Fu4Ikvqin0%2D6gXuQl1WSKrDUiSUZMid2OGT%2DaqL8Ock3cHGAOI9U0oy%2D5IY0XrCFHP4mbjVGffCKU5HuYLr%5Fde2T32XGGhRUtFHmMV3%2DSaYNAmFQNNWA5KuyH6TI1IRycpKhCySf%2D5m0wUMLXRhoBAM9WuLom5LaJ7q6OBt9JuwH0dUuUG7rKVhJQE9pj4AFameIR4YBsqtboE2eC8EnYnkZELjzS56uETCi31myk53lichQILrNOrGZUkg3TIfd7HtvcICXRMdjf0nXnxKGdxiw57%5FwVjPNMKy4udgiIuL0cbXRNuYqqmkUTKexKGuUrdvLlzWKZU1yY2Yz7GnFOM9VSSQ%5FdNIChSFrbUz5FTaWSdLUc5EleXO0mL1U4%2DhCL0RZfeFqSX%5FDYp4Hg%2DSvbwPt3x1mGY5NW9065LV2mwKk6cewzwhL186Zmhoi4TLAMxu3c3w6qQOV13fVDBg%26adurl%3Dhttps%253A%252F%252Fad4.adfarm1.adition.com%252Fredi%253Flid%253D7317245884263303948%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D5158022%2526kid%253D6294036%2526bid%253D19096888%2526c%253D23582%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253Dhttps%253A%252F%252Fad2.adfarm1.adition.com%252Fredi%253Flid%253D7317245888529894409%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7317245884248951818%2526sid%253D4847836%2526kid%253D6274928%2526bid%253D19051307%2526c%253D60885%2526keyword%253DPACS%25255F5158022%25255F19096888%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
last-modified: Wed, 13 Dec 2023 09:14:48 GMT
etag: "2302106755-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 3002

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E7E6 42 B
64 B 45ms
45ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu7iUYlNPic5DzMsBkbNqghCM32b5cSHFSyHU8QvpTTPlN4W6eVwXiffAQM2a0n6uxZeY7t4g05OevmiNOmX1gzCXoII1QyiJp8CRhrXLDnYkrE9GjxWrb2oNVLKwRUtWUx7eu3Y-HaomzdpC55jL_3ANNi&sai=AMfl-YQfQ4B97lf98BaMUE-3gFqAwP9H9NwBgc9wrF8BKHJFyW3vBNcpL5Y2dXRl5FtaoPc0lGX4niwuwmfNcsvc8itA745XYb61kXHYD36rTp69hbjoZhrP7UGMd_f6FfRGRs6xJuB-lv2siLh16p9Y&sig=Cg0ArKJSzAp19m9v2LlTEAE&cid=CAQSTgAvHhf_sGYJblCbIzB8KY1iaGFR_JQ37WJH7UmvgcNoLsBO9YlY4XLbhPkAPmZBlSnTAdywPHi8mCpqSPwIbm54olAqBuaTGAmHduH6VhgB&id=lidar2&mcvt=1039&p=0,0,250,300&mtos=1039,1039,1039,1039,1039&tos=1039,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4282727254&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703679068836&rpt=312&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI1OmLjsuvgwMVehJVCB3DLQKfEAAYACCD38li;dc_eps=AHas8cCvtesJeXWBhIzp6yusRNV63fXElWyGiCaNSVUjo0mSXNJ2KqiJnmINWFhCjTc4_lQkCc04iq8;met=1;ecn1=1;etm1=0;eid1=11;
ade.googlesyndication.com/ddm/activity/ Frame 6883 42 B
107 B 50ms
44ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI1OmLjsuvgwMVehJVCB3DLQKfEAAYACCD38li;dc_eps=AHas8cCvtesJeXWBhIzp6yusRNV63fXElWyGiCaNSVUjo0mSXNJ2KqiJnmINWFhCjTc4_lQkCc04iq8;met=1;ecn1=1;etm1=0;eid1=11;

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content event.png
tpsc-video-eu.doubleverify.com/ Frame 6883 0
162 B 59ms
16ms Image
text/plain 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpsc-video-eu.doubleverify.com/event.png?vstevt=0&dup=e6c592fe-3fb0-49be-bab2-f6f687e11b3a
Requested by: Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Dec 2023 12:11:10 GMT
Cache-Control: max-age=0
Connection: keep-alive
Expires: 2023-12-26T12:11:10

GET
H2 200 dc_oe=ChMI_qj9jcuvgwMV315BAh1t8gg9EAAYACCD38liOhoIuoXQ1gIQu4jbyL4EGL-kxOMDINO1k6aYEkITCI3M_4zLr4MDFepEFQgdbk8Lcw;dc_rmcid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4Ce...
ade.googlesyndication.com/ddm/activity/ Frame 6883 42 B
107 B 51ms
45ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI_qj9jcuvgwMV315BAh1t8gg9EAAYACCD38liOhoIuoXQ1gIQu4jbyL4EGL-kxOMDINO1k6aYEkITCI3M_4zLr4MDFepEFQgdbk8Lcw;dc_rmcid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4CeKQXLA9bJVaZFlgIrMnDuXqopeYV2GSGBjnBgB;eps=CIDhgBAQARgfMgKqAjoCgEBIvf3BOljTof-My6-DAw;met=1;acvw=sv%3D959%26v%3D20231113%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D6016%26vmtime%3D56%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26i0%3D33554450%26ic%3D0%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D390493782%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1703679070210;dc_rfl=%5BURL_SIGNALS%5D;ecn1=1;etm1=0;eid1=11;

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 6883 42 B
64 B 53ms
49ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=ClNH_WxSMZc2yGeqJ1fAP7p6tmAeT4ar5dNO1k6aYEs-Ph_mUMRABIJKygg5glaqzgsAHyAEFqAMByAObBKoElwJP0EcO-xfnI2hCPV2jo3jfDDW8KK6JclwoxCjxGbk1hcg0qupsP6wvuMU8M_68hDxE5yFGJu-FpnCK4CSYQfW4S8KSXexA5ucXvwlyJAEZq0xpYqbiZqBWD_el5XVp_RfXMFjka3QjJlFZS7XpZqfB19Ua6QmAVro86uWHycoS0Jc8gkDGYu8GKAey9uSNwPA_kDyG7hsq_FUvFQ7h7HMLYCsImGXiCNuEW1JsYY5SH5yDHtsDisVdMn1XG7ZcANdNsn_G02Ps5H9WuQQpyHUmz2glFLPUEbytcaCgC9O6PPkooFxOU2pEj8zWM5RxcbCyyiJ_Bg8-mmeRw6ilmqnbNUUGrtezCbIUEfeP9rQopFnxt3TwucDABLuI28i-BOAEA4gFrcWtx0yQBgGgBk6AB5qS6NUCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY06H_jMuvgwOACgGYCwHICwGADAGiDBQqEgoQ5LSxAu61sQK1uLECrLqxAqoNAkRFsBOgwoUWyBO_pMTjA9gTCogUBNgUAdAVAfgWAYAXAegXBQ&sigh=bFE2HoJ0uvg&label=part2viewed&ad_mt=57&acvw=sv%3D959%26v%3D20231113%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D6016%26vmtime%3D56%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26i0%3D33554450%26ic%3D0%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D390493782%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1703679070210

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6883 0
26 B 54ms
50ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDRTbqZYGIcFBJrC6FKAIxDRI4ZIS4QRcq257NpsraSD5fTtAsXNfhEejBq16Kh_LZBerarIye3JMqUtf37WOYmKqEcyUnsblUR46qy4T7kiT3tiAE-v3qJ8whSixkAL--VmuXmT-SF9b8nQ0FhYR63TtuD-NYBUQ-EE72M-CVZD0ipWCoI7CNdA&sai=AMfl-YRLOT0sB_Omd1isIMa4JZrxZdpKHsTE685E_7Ht469xYFtVUlkKTqtBBL1UuhKgaD3RHegOYQcpFsSePVbWbTYM_7Xor2YS-VJS0g&sig=Cg0ArKJSzCTVKQPc0fEDEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&adurl=

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 204
No Content visit.jpg
tps.doubleverify.com/ Frame 6883 0
162 B 70ms
23ms Image
text/plain 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tps.doubleverify.com/visit.jpg?ctx=10242044&cmp=30443038&sid=5513185&plc=380567266&num=&adid=&advid=10957991&adsrv=1&btreg=572283934&btadsrv=doubleclick&crt=206729091&crtname=&chnl=&unit=&pid=&uid=&tagtype=video&dvtagver=6.1.img&
Requested by: Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Dec 2023 12:11:10 GMT
Cache-Control: max-age=0
Connection: keep-alive
Expires: 12/26/2023 12:11:10

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 6883 35 B
2 KB 166ms
107ms Image
image/gif 2a02:26f0:3500:58c::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=11784158&siteID=N7657.3553448DISPLAYVIDEO360&creativeID=206729091&placementID=380567266&rnd=1952858087&gdpr=&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:58c::1ec4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Date: Wed, 27 Dec 2023 12:11:10 GMT
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: unsafe-url
Vary: Accept-Encoding
X-Frame-Options: ALLOWALL
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Wed, 27 Dec 2023 12:11:10 GMT

GET
H/1.1 204
No Content visit.jpg
tpsc-video-eu.doubleverify.com/ Frame 6883 0
162 B 66ms
25ms Image
text/plain 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpsc-video-eu.doubleverify.com/visit.jpg?vstevt=2&tagtype=video&ctx=10242044&cmp=30443038&sid=5513185&plc=380567266&adsrv=166&dup=e6c592fe-3fb0-49be-bab2-f6f687e11b3a&dvtagver=dvot_2023-12-20_20862faf3_45ec3c9&dvp_cfbs=99&dvp_infra=cloudflare&dvp_zjsver=0.21.19&vstvr=2.0-r&dvp_redirect=1&dvp_psf=0&app=-1&essd=0
Requested by: Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Dec 2023 12:11:10 GMT
Cache-Control: max-age=0
Connection: keep-alive
Expires: 12/26/2023 12:11:10

GET
H2 204 /
vtrk.doubleverify.com/ Frame 6883 0
184 B 79ms
22ms Image
text/plain 2606:4700:4400::ac40:9111
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://vtrk.doubleverify.com/?v=1&t=event&tid=ZW-12000000&ec=vast&cid=e6c592fe-3fb0-49be-bab2-f6f687e11b3a&el=https%3A%2F%2Fad.doubleclick.net%2Fddm%2Fpfadx%2FN7657.3553448DISPLAYVIDEO360%2FB30443038.380567266%3Bsz%3D0x0%3Bord%3D%5Btimestamp%5D%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext%2Fxml%3Bdc_sdkv%3Dh.0.0.0%3Bdc_osd%3D2%3Bdc_frm%3D2%3Bdc_sdr%3D1%3Bdc_ref%3Dhttps%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html%3Bnel%3D0%3Fves%3DdGltZXN0YW1wOiAxNzAzNjc5MDY5NDkzCmNsaWNrX3Rocm91Z2hfdXJsOiAiaHR0cHM6Ly9hZGNsaWNrLmcuZG91YmxlY2xpY2submV0L3Bjcy9jbGljaz94YWk9QUtBT2pzdXNTMWJYWXh0dTl1ZUREdWVDcHprMlZnU0xPNkczYm1wbzFJdkozME44b3BHX3ZsaGlCUkZvSWtFdTl5ZFlQM0Zqb09IQW91T1ZTS2R5QzBwODIwbElaRmNfRFZUZGw2aURrcUI2a09CVjZMNVpORG14ZFllc1V3Y3kxVHRhR2tZQVNrZFEtXzVWUFRnTlRmYm5uTkRpTDZvSnk0T0s4UWNrQThZN1FVLWh1UmVOczZua3FzNG9sRmNFRDNxSVFMTjdLSFN5MFhuNVB3aTFfZXpqQmRCYURMQ2FuejFZZlY1bHdfQ01sNEtaNXhCUTMzb1JfYmJrVEVRWHRyZi1BZ3NTN2I5NHRLTy02WXRyRWUwWDk5d3NuamRrNkhIZTgzWHllVHZDanowRGtuTlRrZzdibGlacVpUbzhhUXhGY3hWTWVYdHN4Y2lHdDZFbVJLaFZ6ZHRTM0d5Qk5GOUgtZWEyaU1NODAyVWpvTXdCbFNxODd6SWJIdWxLYmZqX09OdnVyeHBpbjhoZ0p2ZHB6LTlsblpjTG1OU2prSkI0OXZaNWhWUzYwdEdkbGlJM3A3cHp5QXU2eEJReExEWEVzcENUMy1vU0VFTFVyWDMwSmxSNkdmUmdBSXoycjltOTRvSFdpZnVuUnhZcTdmUFJ5RXo3X0R0anEtQ1VVNG1aZUhXVzVsX1V2ME9TdTdXWVJGem8zMU5aNmpFMDdBLVlhSl9JWjJKV3JEQkcwVGkya0hWYWw5UmpDZ0tGajVQV3BmQTNzVkhXSUFzLU5tRlczOG9FbURvVmNYUExtdnNWa3RQdTNPU1RxR2tCSHlBRy0weVpQNm5PRTJab3FvQjFkSm52NmQxVTJNMU5fc1M3MzVQNjVqOC10Wm9LWjVTbkgzNXdCc1cwNzhEOGVmSEc5LTZyUnFYeEMxTlpZTGFSVGxnR1VwWENQOW5DTnlxNGVpdW1mNFlxRWNBMEpSWVZzM0V0dVdrUXBRbHotZnJMclZfRFVmN05vdE02R2ROZmJVMWphd3FOdm95R19acE1XMW9vWnFLejNRYVN5S0RRYmJlVXlNbkZYVUNvT2dUd1dKVVp4TmNDcmxMNllMVFpMbk5IRVFuXzZYejNwOFZFeFI0YUM1alM4RktSdDdQX1RRbU5mdWxBa3FZWmpNMm9xZC1Wcmh3Mm1fWTRzMmsyMUs3cnpvNU41VXZXd1lhUmotRTBnR3VBSHNlM2xpRDh4eVhnaUdCV0dKeFJEWXF6a1A0TmhhQUZHZk1KWDJ0Wll1ZjlmR1Z2b1NYRWtCVXVlaW9ZaW8tbldqeF9tSnlBQl9CS1p6YS15SHJFZ29YNlFEcHJTbFhKNXBLVllvWUZ1Z2VJNnQzVncyMUVFMzU5dXBnMy1LTkF0M19STjJWWUhEdGVseURSM2FfOTZjWXp2Vm9JLTdZM3l3d1VONnF1Q1ZpcWlseVlRdlAxSlFrM2JrVlBDWVJsZVBzbWh4NzEzRGMzY09tTTBHMTVKZ1p3LTktUjJLZUYxZkVZbTdsLXpMS1pYVS1SZ3lLM3JnOUpLM1FSMm1VWHBMVzNkcnBadWVkNHBLRVl1TmY5RTZTQkszbHVJNGpDQXh1ZFBmSDBzNVRnLWZjVXJ0cXkwYzdfcXAyS1E0VW1hSklUS0duZFUzNmszcmVidjJFOFZ1Z1Y0dUItRlRpaUZnWXVQblF1WUFsbk12cHZGdDN1WGlHQTFPY242Nk5TSFQxblZuY1RKek5ZLW16LUhNZDhQbWdiQ2ZWYkhZQW1zNXl3OHRZUjF6RTRZeU5jTnNVbGpfbm9WRWN1eVV0NHRNSSZzYWk9QU1mbC1ZU2ZoNFBzZVFaclZuZUhBYld4MC0yMTBDVEdhVjhzZDhGR2dXMTdlcUpPZmdtUldpWTN3TS1uejBkTURSUTkzQ2tVZEtBUUlxMHdZQ1VFX1JnTDJrY1BYWkNxaHdtaGhBMGFKS09NWDZ1Q19XRzJLaDBMZnJEMnlVcjhaMVlBOGdpb21XMjdRY0dIYldXWWhzZlZscXFKQkZXNXFkX2N3dkZSdUg0Yk9QS1VjTHQ5ZG5PSWh3WWkzUGgtaERxZ3p2ZE5yZzI5dGJmM0xyWE5mZExLcFJrblJmM3Vmc0d5NTlYMTFBV280dmdyOWxDTUVmWXRWQ2k3UmNvanZ1X2tlS0trVUY2V0JLdlFqMjF1SkRKUHlZaUZ2WEp2dGpVTTFHdHYtRWdiLURCbzhTXzZWa2Mmc2lnPUNnMEFyS0pTeklNRDdLVl9jZTNZRUFFJmNyeT0xJmZic19hZWlkPSU1Qmd3X2Zic2FlaWQlNUQmdXJsZml4PTEmYWR1cmw9aHR0cHM6Ly93d3cuZWEuY29tL2dhbWVzL2VhLXNwb3J0cy1mYy9mYy0yNC9mZWF0dXJlcyUzRnV0bV9jYW1wYWlnbiUzREZDX2JyZF93d19tNl9wcmdtdl9kdjM2MF9tZiUyNnV0bV9zb3VyY2UlM0RkdjM2MCUyNnV0bV9tZWRpdW0lM0R2aWRlbyUyNmNpZCUzRDczNTk4JTI2dHMlM0QxNjUyODkwMTQxNTkzJTI2ZGNsaWQlM0QlMjVlZGNsaWQhIgo%26dc_cid%3D206729091%26dc_adid%3D572283934&ea=impression&cm114=0&cm115=0&cd101=vast&cd102=src&cd111=wrapper&cd112=csu&cd117=-1&cd170=166&cd182=vpaid-transformer%400.21.19&cd188=FRA&cd189=cloudflare&cd190=10242044&cd191=30443038&cd192=5513185&cd193=380567266&cd196=3&cd141=%5BAPIFRAMEWORKS%5D&cd142=2023-12-27T12%3A11%3A10.219Z&cd143=2023-12-27T12%3A11%3A10.219Z&z=91758005
Requested by: Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:9111 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 83c176ed3fef9189-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6883 0
28 B 56ms
54ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsssoaTAIOLLDUfRrWiOApiAELviqAXwkl2GU5q6ZDU6oO2LS3344UlsgChcBFLFkW5fcXjOKMfgRDbZPa_u0NeyeVZQgXPPFt2Tf_jH5FOmDAhKKJrR8lQ9cPdFbnvHfri5U6Pygk81FJc_RejiIZo4CYdogNTR9EkfZV4BuHB0novcWMSjmnqh0SFaiIBnLs1ho0TUmQwhiy4NMAUcE8J2i8qO7S_dVSI-wOXK9EX9qPWNNwh9ExORsBjeqNRY2aZARonOV3qkXnZnH7PFVn7HNYl2UC3udlRxAtrr4b1rGy48rz8hUAeO_ptkyWQO93hB6TW-FUHfwbSsAdNKa6VqS3xI3QNJKkyqwsc_8c19-306xsdEOld86TYyewraM87u12SX_1ZSwGaImdNj7D2rSHdKxpX4wsK0yJXDzOXn-4qzix7BhCh-7DluILbxG1FFjqNq0DV6Hbv7fww409iv0FNkKpC2h5kFoJCEcef0ZNBUZhw8cBrEmqQXqaJHrbGeIThcswlsXLTkniLjVYDth9zGMMwOc0PHKLu3y5YoC8_fyWubPs0m_H36dENyIUd_WMLLu7nO5lo_pScbCuyIFU2YcXEtDT6tkj7pmu0yTziRMwKXdcEDQsYrLOmxCR2Knkk_TL_SHWyPKA7t0iXpjIExAdknO9897zxw2Y7GF0-X7pk-tyZlPUid-3Hzb0SBRNpPZPJoIPEhDK-dcytJF7Ea46KxY_T1xYvfrCKL--3142ojx9o6xOcNNnzedEBWswHuAqEPSgPaJKysG34VyHlGOyDGPHYBnn8ir2PI2QobiF3CFhzVsBhVaUQPGTeFdwVDWixBJaZuIHcgvPsQtm6DkPXLCeR3yXFRh7wUTYlGN5-pK27KCdxd0eNYK76h_1QChoT_KMiJaH5YXGtaePxeuhoH6Oi7fpss0jMkLwg_Scg2bFTrf-60WBT7idAVTFTdKJHZh338U327xsJTQtUoAW59iVhfU22m1_ssJEls2Bv_qnYo0S3ToaIYSChsuNnnZXVT7q4dckuYkh1AFTtwhK_VlbNDSJcScu0scnNGjQe-MkGAGb_5o0WyRUgSfFsX6i4JDA3781KDCjcJs0zEX45URPuu-6prztFE8ACBZzgGDFDmQUZFNrG3sMwE-JbpOhGvgTp8U7OB6csX_qfQx7D4dKvSDC7X51gPlUH9em5Tp1CxXX29T3rTz48Qu_rZ6AgzZnlAEptU1iQzXVdP3PAgAxNYHKbBfmH0X6Gw5FEAzOHZPMLtZKcT9X215atPNAt5W7nF4b9Tzbz5_p9TyhyQOSj_SHjylCZVi98SSzkDGS-DiKfXuct6NxD9Ibg&sai=AMfl-YSSoRoupyLcIRHjYkYnyKOv__elh12EvjufqPF_TU6GZC3TU6ob765931p8ZY9-j9E7W0-voH7nvAhdm1FCHIy_uglylEr0RGTu-Jp_cfTaFBY6ERj53t7XTwsPdlFxqE1fZ3fe-h2sgc-wrqhgLIpr5hg4HwryQhwlWdbKpiArl9FMXrWPECDdTYChw-25vqdBMOnjGYtw6jFId8aDoOq-rdGGAjBzFrQHBEMYGx386uLaKhYuv1FSZEZvYqkNxP6Udvw_4GxuZpXvLvz8cyKoeaR9FYvDOZpm1A&sig=Cg0ArKJSzNc5Aq8NB-UXEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&adurl=

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK adServerESI.aspx
secure.insightexpressai.com/adServer/ Frame 6883 35 B
2 KB 136ms
78ms Image
image/gif 2a02:26f0:3500:58c::1ec4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.insightexpressai.com/adServer/adServerESI.aspx?script=false&bannerID=11784158&siteID=N7657.3553448DISPLAYVIDEO360&creativeID=206729091&placementID=380567266&rnd=4024846582&gdpr=&gdpr_consent=&redir=https://secure.insightexpressai.com/adserver/1pixel.gif

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:58c::1ec4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22816a00dfe9fcdc30063d22717ab9cbab3aeb2a8e9844e9d774d256dc48b7c8

Security Headers

Name	Value
Content-Security-Policy	default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src ; style-src 'unsafe-inline';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Content-Security-Policy: default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Date: Wed, 27 Dec 2023 12:11:10 GMT
P3P: CP="NOI DSP COR NID CUR ADMa OUR STP STA"
Connection: keep-alive
Content-Length: 35
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Referrer-Policy: unsafe-url
Vary: Accept-Encoding
X-Frame-Options: ALLOWALL
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache
Feature-Policy: accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'
Expires: Wed, 27 Dec 2023 12:11:10 GMT

GET

partner
sync.search.spotxchange.com/ Frame 6883
Redirect Chain

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyAIxC6hdDWAhiPnpb9ASABMAE&v=APEucNWDjNhqLemHC5w6UoeSBRPLrWsZgvMZbhqPvcTzEgwx88MtOy0c0fViUF3eT8adakhLgQ7ktpXLP56J5T9o-1cfi9cNOA
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID

0
0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6883 0
24 B 44ms
42ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 6883 42 B
68 B 51ms
49ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuYOQO_bubf1iwyM1-fgklQe1spC7c6T0BoMsGGjmgl6K5OUK_rdGJQ1ge5Sllo-eiTcjKOn3uQlyGQyif1fgScBamrR8yDqd9XHNqR9CZEbisd-sZ8LcwSO9cU7HzMALkAc837P2cvKZA&sai=AMfl-YS3ntewbN3i8jj1HQTY_eFPZfsRqQvoAcF7HAdYaxubqZjw5xC5MKrQ1xn5iIRwynTRfk_DfnA1oeJiYthgkpAZkK7T5e5TBmBHJJGn7WODxPJXwtVim5-9KgOZ_jOe70bdBkUNT1BV2XwogGNP&sig=Cg0ArKJSzIHn7g0P0M6NEAE&cid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4CeKQXLA9bJVaZFlgIrMnDuXqopeYV2GSGBjnBgB&id=lidarv&acvw=sv%3D959%26v%3D20231113%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D6016%26vmtime%3D56%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D33554450%26ic%3D33554450%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D390493782%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1703679070210&avm=1

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 6883 42 B
64 B 52ms
50ms Image
image/gif 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=ClNH_WxSMZc2yGeqJ1fAP7p6tmAeT4ar5dNO1k6aYEs-Ph_mUMRABIJKygg5glaqzgsAHyAEFqAMByAObBKoElwJP0EcO-xfnI2hCPV2jo3jfDDW8KK6JclwoxCjxGbk1hcg0qupsP6wvuMU8M_68hDxE5yFGJu-FpnCK4CSYQfW4S8KSXexA5ucXvwlyJAEZq0xpYqbiZqBWD_el5XVp_RfXMFjka3QjJlFZS7XpZqfB19Ua6QmAVro86uWHycoS0Jc8gkDGYu8GKAey9uSNwPA_kDyG7hsq_FUvFQ7h7HMLYCsImGXiCNuEW1JsYY5SH5yDHtsDisVdMn1XG7ZcANdNsn_G02Ps5H9WuQQpyHUmz2glFLPUEbytcaCgC9O6PPkooFxOU2pEj8zWM5RxcbCyyiJ_Bg8-mmeRw6ilmqnbNUUGrtezCbIUEfeP9rQopFnxt3TwucDABLuI28i-BOAEA4gFrcWtx0yQBgGgBk6AB5qS6NUCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY06H_jMuvgwOACgGYCwHICwGADAGiDBQqEgoQ5LSxAu61sQK1uLECrLqxAqoNAkRFsBOgwoUWyBO_pMTjA9gTCogUBNgUAdAVAfgWAYAXAegXBQ&sigh=bFE2HoJ0uvg&label=vast_creativeview&ad_mt=57&acvw=sv%3D959%26v%3D20231113%26cb%3Dout%26e%3D19%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D6016%26vmtime%3D56%26is%3D33554450%26i0%3D33554450%26cs%3D33554450%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D390493782%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,200104c,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1703679070210

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231207/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
54 B 272ms
270ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=7~lqnqj3oh&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=2076&mt=video%2Fmp4&vs=1024x576&dm=6000&event_name=first_play&asset_bytes=215401&video_bytes=300&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=11&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=1&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=vil.26b~ff.26m~videopreviewstarted.26n
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adplayer_privacy.sjs Show response
imagesrv.adition.com/js/adplayer/ Frame F6AD 20 KB
6 KB 83ms
82ms Script
text/javascript 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_7317245884263303948&title=PIA+Advertising+GmbH&text=nutzt+u.a.+die+ADITION+Adserving-Technologie.+Mehr+&url=https%3A%2F%2Fpia-advertising.com%2Fopt-out%2F&linkText=Informationen+zum+Datenschutz%2FOpt-Out+&pos=top-right
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/270/oba_priv.sjs?oba=&domId=obaButton_7317245884263303948&btr=true&pos=top-right&cid=34720&aid=34720
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: b86bb85dd65718930d1e5d4e73b979ec27515b0c6b6828df8e072df9ff083f49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
content-length: 6040
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0890
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIQZMh0tuCyV10lN1GhRb3k&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIQZMh0tuCyV10lN1GhRb3k&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RlV3RGNMNTAxUmlzS0c1&google_gid=CAESEIQZMh0tuCyV10lN1GhRb3k&google_cver=1&google_push=AXcoOmSxxrk7RKsesh0kKv_y_QSLPtAlrQMNXPA_0zPp2D2...

170 B
188 B

20ms
20ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RlV3RGNMNTAxUmlzS0c1&google_gid=CAESEIQZMh0tuCyV10lN1GhRb3k&google_cver=1&google_push=AXcoOmSxxrk7RKsesh0kKv_y_QSLPtAlrQMNXPA_0zPp2D2L7q9a4OmIZgpXhVQLokkXuPgZvNIAzRU9oZWv9rjK4jXu_Xd9_Z-fmw

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 27 Dec 2023 12:11:09 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=RlV3RGNMNTAxUmlzS0c1&google_gid=CAESEIQZMh0tuCyV10lN1GhRb3k&google_cver=1&google_push=AXcoOmSxxrk7RKsesh0kKv_y_QSLPtAlrQMNXPA_0zPp2D2L7q9a4OmIZgpXhVQLokkXuPgZvNIAzRU9oZWv9rjK4jXu_Xd9_Z-fmw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0890
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEEQ-fipucpaegxTVfWAIl-M&google_cver=1&google_push=AXcoOmRd9LYSkk-wVZNSs6iU1F268RsEeCgGIls0JvbTvU08pmMlrWwabkTSmxoSQcAgKoNhYmgqCo2wJU5OpmR_u6RvrKdjzMKvyw
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=94FAB145D8FF4B7498A53817898AFEE1&google_push=AXcoOmRd9LYSkk-wVZNSs6iU1F268RsEeCgGIls0JvbTvU08pmMlrWwabkTSmxoSQcAgKoNhYmgqCo2wJU5OpmR...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=94FAB145D8FF4B7498A53817898AFEE1&google_push=AXcoOmRd9LYSkk-wVZNSs6iU1F268RsEeCgGIls0JvbTvU08pmMlrWwabkTSmxoSQcAgKoNhYmgqCo2wJU5OpmR_u6RvrKdjzMKvyw

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Dec 2023 12:11:10 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=94FAB145D8FF4B7498A53817898AFEE1&google_push=AXcoOmRd9LYSkk-wVZNSs6iU1F268RsEeCgGIls0JvbTvU08pmMlrWwabkTSmxoSQcAgKoNhYmgqCo2wJU5OpmR_u6RvrKdjzMKvyw
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 26 Dec 2023 12:11:10 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0890
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBUuqW2FwxRuwsctA8axMmw&google_cver=1&google_push=AXcoOmSdPFLcKR73enczZKB0vagfJE_aXgg3hf265OYh0I04qTsoO-2MRwv3Qr-6noiKWuPN3JNXExi3Bi3iB-bn...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0R1JGZ--RxgvEUahyjeJfA&google_push=AXcoOmSdPFLcKR73enczZKB0vagfJE_aXgg3hf265OYh0I04qTsoO-2MRwv3Qr-6noiKWuPN3JNXExi3Bi3iB-bn0w8bozSNMaqUJA

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0R1JGZ--RxgvEUahyjeJfA&google_push=AXcoOmSdPFLcKR73enczZKB0vagfJE_aXgg3hf265OYh0I04qTsoO-2MRwv3Qr-6noiKWuPN3JNXExi3Bi3iB-bn0w8bozSNMaqUJA

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 27 Dec 2023 12:11:10 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0R1JGZ--RxgvEUahyjeJfA&google_push=AXcoOmSdPFLcKR73enczZKB0vagfJE_aXgg3hf265OYh0I04qTsoO-2MRwv3Qr-6noiKWuPN3JNXExi3Bi3iB-bn0w8bozSNMaqUJA
x-host: tde-deliveryengine-production-59dc4ccdb-25hrn
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame 0890 43 B
146 B 84ms
7ms Image
image/gif 18.198.94.178
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEM90NzpPc8kITjd4aA_i7kw&google_cver=1&google_push=AXcoOmQI5LuQ-E9nIUeK2WeMIxAaOsteNwKBCOfseirxY7v1kWaRMRc1F9UrskbHLoJl2e3lEX-0QlmXw4zOf5qxZW5myl6SoKLrjA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.198.94.178 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-94-178.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0890
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEJUw1c1H6tBJphf19Dbd5Jk&google_cver=1&google_push=AXcoOmQeAVRppLIIh1YAzFtQ2yqGgFrR4bvLrEJYjA0QKNmxi5QkxA2VnVgvnbmAB6haqL3zEZEC-dmhlV1P...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQeAVRppLIIh1YAzFtQ2yqGgFrR4bvLrEJYjA0QKNmxi5QkxA2VnVgvnbmAB6haqL3zEZEC-dmhlV1P6kuk9ui_LDfJV9IapQ

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQeAVRppLIIh1YAzFtQ2yqGgFrR4bvLrEJYjA0QKNmxi5QkxA2VnVgvnbmAB6haqL3zEZEC-dmhlV1P6kuk9ui_LDfJV9IapQ

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQeAVRppLIIh1YAzFtQ2yqGgFrR4bvLrEJYjA0QKNmxi5QkxA2VnVgvnbmAB6haqL3zEZEC-dmhlV1P6kuk9ui_LDfJV9IapQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0890
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEJjvz3-ESB-oyr0_WOM5PZQ&google_cver=1&google_push=AXcoOmQrSjIjN6cJ79g-AkQkRIIXlpOX0vfzywPyqqFgtZyGKqJQf_O50RTG6jAtZ5...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQrSjIjN6cJ79g-AkQkRIIXlpOX0vfzywPyqqFgtZyGKqJQf_O50RTG6jAtZ5k6ByRn4JNcAyl467jvIKCofH7JXg4gASDu6mc&google_hm=...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQrSjIjN6cJ79g-AkQkRIIXlpOX0vfzywPyqqFgtZyGKqJQf_O50RTG6jAtZ5k6ByRn4JNcAyl467jvIKCofH7JXg4gASDu6mc&google_hm=zak05DqKSCeJD7HlMxfuliU

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:09 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmQrSjIjN6cJ79g-AkQkRIIXlpOX0vfzywPyqqFgtZyGKqJQf_O50RTG6jAtZ5k6ByRn4JNcAyl467jvIKCofH7JXg4gASDu6mc&google_hm=zak05DqKSCeJD7HlMxfuliU
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

report
sync.teads.tv/um/ Frame 0890
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEHK3b0zGVUgs...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmThlK45VQo0Ub0Xu9iT3RH8HKMnlrC7tPSsvD-n3XdlZ_45a7UN4M0j9DUR5jR9uUDnfJLHnNGgbXJ8JVb55qouUOdf_mL3coU
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

38ms
38ms

Image
image/gif

23.211.8.12
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1784742484268469&output=html&h=90&adk=2743202993&adf=54630664&pi=t.aa~a.772858473~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1657202602&rafmt=1&to=qs&pwprc=8995255381&format=1200x90&url=https%3A%2F%2Fxn----7sbdfpa2ceibrhv.com%2Frabotno-vreme-jumbo.html&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1703679068946&bpp=1&bdt=1957&idt=1&shv=r20231207&mjsv=m202312070101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D5c2becede107c8c9%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MZopBEZKk5PapazDZ5srkxyQ46Zew&gpic=UID%3D00000ce8bcaab7f0%3AT%3D1703679067%3ART%3D1703679067%3AS%3DALNI_MaWI1Uff_VzqwPUYKDgZVeiuyzVsQ&prev_fmts=1200x280%2C728x90%2C336x280%2C0x0%2C1200x280&nras=3&correlator=797003850337&frm=20&pv=1&ga_vid=1939296449.1703679067&ga_sid=1703679067&ga_hid=1529806403&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3643&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079979%2C42531705%2C95320870%2C95320885&oid=2&psts=AOrYGskhyw_HAAD_9cNNSuWy9a6EUF-M2H6S1rYJfzknKZqiHGK7_oxC_sEA_2zBxnNslsn2lOkMVCk8k8x4PZokcfA2Zg%2CAOrYGskSe5V1SXeDZHr8nl6Ut7t9Msrphv_Msqt0k6iHO89QCgjdfokVSB9fesRf8vsMV6AjzxWolLR_BN3G9JKeO0bxPBw&pvsid=3570524922569749&tmod=1249513866&uas=0&nvt=1&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=2&fsb=1&dtd=8
Protocol: H2
Server: 23.211.8.12 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-211-8-12.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

expires: Wed, 27 Dec 2023 12:11:10 GMT
pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0890 0
12 B 21ms
20ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K3BN2adZvwkR7CVlvR34ibXInu99_TsZ1326xUKwcrah29_AYpB8rMUmsHslqpIxaJfmrGz44

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DCA2 0
24 B 45ms
45ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=B4_5uXRSMZb6GHd-9hcIP7eSj6AMAAAAAOAHgBAI&bg=!gIOlg8zNAAY3kmNgF5I7ADQBe5WfOKs2xwV-KFnsGPGAABA1IDt5OWTvI_Ah3YvRtRh5kleIQgSpGzI-dyEgsd18Mg3FAgAAAORSAAAAAmgBBwoAI8845x9TUC9ue4HN9ui3RFqEmtydJb-pe_TCqvpTH_rGXKQFmQMlg3cmXzBI_hmbnlNOLcC8H4Fz92sTOfv7xKkPb9CvcyWQU1fT347WonAgPd-ns8VBaBesGGjJQaIOd-UURsiBVPRvRS-TZdSqNJLcTWqaNOk55NtXqCb3f6wSX8zomllqNLtHf72fAv3wnP6rVMOAwiKlLjV0FP7M5F1GXzLqoYNzOkmJFSQ03vlo3vLHpA05StLZzvVTMtIczhmbLd2BZ-nVOkDFLQwttv6gX4YvQmgGZfOSv_-IKkD6XICOIUDrRau1BNcqMWC1LmPhJbURvj-qXzyr9QEVt3iJEggktO8I0eo_KIS6oU6hw-PMH0_qCI61TkdfuDZEmNWxCL3BOnK0iiTjfQ2ZuL6rSB45XfHzNHshusqYJIWsbqD8DEFynXN8EjSaSU9QQTcjo4FoKfn8K4aZ8LdNE_xG3tf0Q9D1NzPVn_FpwXQRCNvvrx8FK_7PMwXnjboYCaLnRKoAJ_OpymtlljpHJKe_BxDqHBaV89HbISPi8xHO33e3H0HVhtYpCzAXlUvjUvYKV8zPYNGYpPiY0i8pZ2LOsoqQz-4-AeL5-QdEaYf07NirF_9qIbubCIOGOzSf59xLXboUpdMVxgvSKqH6MPwTsJVaoVTm3yjYYCIw_LuxupHXWFG7y0sDb2vbBBHZC_kMwEc-pia5enP1AscUEUUJfGZSo6_cBAA8ypZxaG7Gtdp1CeLwcNUjgxx7FPlgoqgq3qcfryOM-MKm1m5mrw9MQ6V0vkcg0XGdHzi0Tj03a3eXVONxddAazx7LM9VIGMlyVd_kSyQj7tARqi4xgKPNOWRjEVgtLtbujjM04jODJ4RF7n3nfh5kVc1rTk2iG3IHZvqEe6mrWvFLQI-rusfrbQnLey10hHBy5EhwSGvOIMwaUZvJ2JDOmB-fbXKI1g6g4wMVvgzU-1Ce7kUUJyxRdV7V_qR96hdez-xK-d-p1KSRUrI5KQYF_b52zs79aD1FIFlDKrCadqYA142fIoGCGLnHO7yYGa9kwq94Zr8aG9UeDAdV7LZdKb9QP1s17-6e1uuPVo7T3v8cVjhGOpNdvum1N15kqjwOaA

Requested by

Host: xn----7sbdfpa2ceibrhv.com
URL: https://xn----7sbdfpa2ceibrhv.com/rabotno-vreme-jumbo.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adplayer.min.css
imagesrv.adition.com/js/adplayer/ Frame F6AD 3 KB
998 B 14ms
13ms Stylesheet
text/css 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adplayer/adplayer.min.css
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_7317245884263303948&title=PIA+Advertising+GmbH&text=nutzt+u.a.+die+ADITION+Adserving-Technologie.+Mehr+&url=https%3A%2F%2Fpia-advertising.com%2Fopt-out%2F&linkText=Informationen+zum+Datenschutz%2FOpt-Out+&pos=top-right
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: dc1ca4850a9ee967d6ebcb561007bdea073f8380ae5a0a4f634945e3f9b59b87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
last-modified: Tue, 30 Oct 2012 15:33:13 GMT
etag: "524465627-br"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
accept-ranges: bytes
content-length: 918

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 111E 0
24 B 47ms
46ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B_BJlXRSMZcu-KeLf1PIPrvaFiAgAAAAAOAHgBAI&bg=!kpGlkd7NAAY3kmNgF5I7ADQBe5WfOM7l9JyeYy7FaeW_b7nWAMQ9yJ6DUrtVhUCHcYojsaHxQ-hGNmWt9SDnrX69L-hLAgAAAKlSAAAAA2gBB5kDawfoj5-H1yWaEn9uqyhEKufyQ9j753cEXZpy9V4DEvpKhpPtLMUefqekoqtHuwm-c3wDS4FT3ZP9z3GUzA4JWD4IHc-vxrl9Q5T-JDtfu8-QgMZClYHZL9za0ymRd_-MV4eJh1hKt9FNk7nJEoaIUkz__c3mjwxV4X8wq90oqTVB85fHFwqFIjtn8LD-visyKoM545EHgp_yeMehOUko5DORF1P6DJAUaaIL9XnulCLpEuVpuas3UdJYE1W7sTs3l8D1nIxs26INx8v_NTM2OJQK-IFgbG7ou9xfjOHvGv3Ghm8eRKniSmad_HfH_lLvOZKilqTAcs6S-cZEh2WjyVHkf8BQaKKpIFHTD3cfxiEI_4mmydY_Wz_QFV5Rv8EPrvPHOA_mcFKByOGMsFGc91E1P51AFESegRknqho08h3Gq12n1IiSdVSVZiOA5JVgK-HICOhsuGMaR0PD2svTjO7uS6PGxpYYEgDDUXKsb-MQZRujKV5FZQw78a_benjdgXMiHlwfkDZLtnH656MXUB-F2902l-QsznhoDj3LCEhIU6x3PtsI_ET6KQ4zVZBWELkax6I2sno7Cq5Pu9rVAnt9qCBopJpQkdw9i9yPlzeVaifGISRK6ocSDtsBwNBtYLn9WdGMF6ZRvj_LkhjM-TKO_xeCjxcI8yS5ub1Ld07FbRuPdaFmRuUDUGFVoAf1G_GJvhagKb6b0Jxs8glLOmS9lGjVWsRgMFn8dlJwKM5azXbHD73sxjMx9lPPGRJLHjsQPQIHStoUiwTd0Izevv3pEd0WiBXej1AZeIgqB9-LbxFsNvrnIXutHMmxMXhrQ2B8GJiqCUvRARpoIvu90EiWjUbC2KHz8Hey4ttoDgivw_W6S3zV7-JvZ0Chmr-BxEJEr9PwMA9HG5oSf2I1cEwMcEsigB6W945CDITeRzv4Z3nFv5mwZiCOiXewvT5_ehS7-u7ejMkbjzWFnTTD1r_jR-F0PgJvxFSIaOM3UPzku3hMg7RX5JVYq-3Qj2wZYNcTkqTZ9-_TKZ_js8aXZeosld2kZVRmz_l9d5sES_zUfiiMrYSK8uAyxxzn64pdqFcv5uRpOlsFVklXiTvaeKh9aYgh0GExlsxwtwr-e4UUfHZL3YA2qMObLPGVC_XcerQQ_0A3NDNDFOLQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 oba_icon.png
imagesrv.adition.com/js/adplayer/ Frame F6AD 3 KB
3 KB 12ms
11ms Image
image/png 217.79.188.59
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/js/adplayer/oba_icon.png
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/js/adplayer/adplayer.min.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.59 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 2eeaed1b310e214596abec926291c1a41c6333ddaeac312886fc0b5930d71f0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/js/adplayer/adplayer.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Tue, 30 Oct 2012 15:33:13 GMT
accept-ranges: bytes
etag: "502461915"
content-length: 3262
content-type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 59ms
59ms XHR
application/json 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231207&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

494d6fa6ac2c9bdd3895a8809fef4fa6203de8e6ec6243fc2479edc66f913719

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xn----7sbdfpa2ceibrhv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12420
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xn----7sbdfpa2ceibrhv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 27 Dec 2023 12:11:10 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0C68 13 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 214078
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 25 Dec 2023 00:43:12 GMT
expires: Tue, 24 Dec 2024 00:43:12 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame F390 829 B
559 B 18ms
18ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1bf3cae23b58b2c0c32ca95aec6a2a4594ac020d571a83d14a67cec9a4d2e28b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-P4pl3R9_doeSiHLe9P5g1Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xn----7sbdfpa2ceibrhv.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-P4pl3R9_doeSiHLe9P5g1Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 27 Dec 2023 12:11:10 GMT
expires: Wed, 27 Dec 2023 12:11:10 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 0C68 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Mon, 25 Dec 2023 10:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 179748
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 24 Dec 2024 10:15:22 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 6883 0
54 B 271ms
271ms Ping
image/gif 2404:6800:4004:80c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=8~lqnqj3ta&c=780732751459&slotId=390366375729.5&qqid=CI3M_4zLr4MDFepEFQgdbk8Lcw&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=Infinity&br=2076&mt=video%2Fmp4&vs=1024x576&dm=6000&met.4=vfl.27e
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20231113_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4004:80c::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame F390 0
0 42ms
42ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231207&jk=3570524922569749&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0C68 0
11 B 7ms
7ms Image
text/plain 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?pO1DoQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date: Wed, 27 Dec 2023 12:11:10 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E7E6 0
24 B 42ms
42ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=3046132941148&version=m202309260101&ct=119&x=1&cor=14742596278492654000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4E60 42 B
64 B 46ms
44ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstV16xqJ2tfZkpq3t3bk5-1_jWlfMYPXQNIO2Cl5jLNg5DbUt1S-PRcM1WWkRH0tzRKOgr8GwGV5DZArJuskybWTf9hQ3Ka68kuL3K2LxYkv7QJBlSI&sig=Cg0ArKJSzPXZ3yKhXtATEAE&id=lidar2&mcvt=1000&p=0,0,600,200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703679069029&rpt=269&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8B71 42 B
64 B 46ms
45ms Fetch
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv1SaQz_Rw9aL0s86rqbbP8ZL9alFMUNfAnLDQm2rhPMiGiVjLHX2qfwuVVsyeiPKw7btVso_-c4nD7SqmPyA5BnuUCZyim7GFx_L_HGPF2-fKZdECT&sig=Cg0ArKJSzNIydJeii2gTEAE&id=lidar2&mcvt=1006&p=0,0,600,200&mtos=1006,1006,1006,1006,1006&tos=1006,0,0,0,0&v=20231213&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1703679069027&rpt=190&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:10 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 7D40 0
127 B 19ms
17ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:09 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

POST
H2 200 all
csm.eu.criteo.net/ Frame 9DE1 0
127 B 17ms
16ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 27 Dec 2023 12:11:10 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231207&jk=3570524922569749&bg=!TU6lTgHNAAY3kmNgF5I7ADQBe5WfOFGvrA4-Ij7oRw2JXVC9biFuRl5hA11PfTiTgxvHrR1MYVhZeb9YUuJ23_8mnNSQAgAAAE9SAAAABGgBB5kDJUccc23033cEHaWudonENb4JIQ8CGrBj-QwqHsRW5EVRbXnUNizONJS_ywRt3Jx87ihmO5ts98gqAG9hEWmnhzfxoJ0tIbKmvVeE4qeLUNaxyZX38wJpncrhwp8bIt3Pes5K6lgcHbRp3iAn_Vz23KFbEP9HdkuHfcQ4tx4hveeKpQ9M3Fs5Uc2t7xJJHwJs0TKHmFJQcDasY31tp920TWkMu5rPHNq16gDLA79zj9yzVhZUmVhaC0Kbp7swG0HW8eikfe6OdOB14GBAlpR3fjyTrRF47OVQ2QQMDMQeHUV-pEtHQmAXo7M1AwJTEkhRGKKjEe5G9gaeccntrHam6Z8vqo9KcIcXgTCUOA8wItM7doj10IhXfrL0_ANmzOa4Ltc0d6Ietn85npyGDYZDzjFsZRsXqTLRf3VCLLYub4sZmZ7GedCyro21O70iDruM3UfCFbwuFk7JCm1413YiiFqhB_Yk71As43FRZXmIXrgwm_sqVDJkg342QAiMGsgAlellHP6W0Gb7myKE02eRWlhqeWaKkZm7qAk8OxZ6D_IYEVOThkBj4ws2XZkG6-w34xpr1yD_4nByrzHFgcPn9MDpQc9ZzIROdtC_iMbk3xPqVBQeeJQcx2QdFcGFNQx7sZyiluj8vr_djpsQx_2Y1lZzTbYNYsQqMrstBmV78tGNhF_h1n29ilfjBs3AtzhwhvyJXLu0G9I2keiD2SEkJj_Lggqef_2XuArCUQFVZ4aiCcBWzUejanv0U3Xx1qIhroGKIKJcPRWZ73ztWM6Iza6ABZ_9duNPuTEVG764asTBfmammU-ysu0sST7AFgYkU2Y-YquHUC7DuAwby0OIyPwAmMsillXIcf1Uj2Vhq25ri_zDliGLXTOuILN1bXV7pvpFhll1UQxFIjrOWYVy9FItmkxkz_Tq9oxARUes2TqciA1vPpnmGX_1WEmxJME1qo8m3IUwecb9Xc__2u8hVr7JxFrBKITYkhGXy79IkEFbYcoUfL9FUxRjBXFihlJ95pPMgRsLcLqjLKt9ooB-NorxxhgMjKmupqU0Hh7uKjbhaaLxn6U
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://xn----7sbdfpa2ceibrhv.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F6AD 0
24 B 43ms
43ms Ping
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5464700053165&version=m202309260101&ct=77&x=1&cor=12719247477613752000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI1OmLjsuvgwMVehJVCB3DLQKfEAAYACCD38li;dc_eps=AHas8cCvtesJeXWBhIzp6yusRNV63fXElWyGiCaNSVUjo0mSXNJ2KqiJnmINWFhCjTc4_lQkCc04iq8;met=1;ecn1=1;etm1=0;eid1=960584;
ade.googlesyndication.com/ddm/activity/ Frame 6883 42 B
63 B 46ms
45ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 27 Dec 2023 12:11:11 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content event.png
tpsc-video-eu.doubleverify.com/ Frame 6883 0
162 B 17ms
16ms Image
text/plain 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpsc-video-eu.doubleverify.com/event.png?vstevt=4&dup=e6c592fe-3fb0-49be-bab2-f6f687e11b3a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 27 Dec 2023 12:11:11 GMT
Cache-Control: max-age=0
Connection: keep-alive
Expires: 2023-12-26T12:11:11

GET
H3 200 dc_oe=ChMI_qj9jcuvgwMV315BAh1t8gg9EAAYACCD38liOhoIuoXQ1gIQu4jbyL4EGL-kxOMDINO1k6aYEkITCI3M_4zLr4MDFepEFQgdbk8Lcw;dc_rmcid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4Ce...
ade.googlesyndication.com/ddm/activity/ Frame 6883 42 B
63 B 46ms
45ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI_qj9jcuvgwMV315BAh1t8gg9EAAYACCD38liOhoIuoXQ1gIQu4jbyL4EGL-kxOMDINO1k6aYEkITCI3M_4zLr4MDFepEFQgdbk8Lcw;dc_rmcid=CAQSTgAvHhf_-x0scC_knNgu7UPmnqmDwnGT_GbLAvh2482uDRDE2xnjAy-MneSG-ov5Mz-w4CeKQXLA9bJVaZFlgIrMnDuXqopeYV2GSGBjnBgB;eps=CIDhgBAQARgfMgKqAjoCgEBIvf3BOljTof-My6-DAw;met=1;acvw=sv%3D959%26v%3D20231113%26cb%3Dout%26e%3D1%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D1,154,119,363%26tos%3D1287,0,0,0,0%26mtos%3D1287,1287,1287,1287,1287%26amtos%3D0,0,0,0,0%26mcvt%3D1287%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D1502%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D2%26pst%3D215%26dur%3D6016%26vmtime%3D1560%26dvs%3D1287%26dfvs%3D1287%26dvpt%3D1502%26is%3D33554707%26i0%3D33554450%26i1%3D33554707%26ic%3D256%26cs%3D33554706%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D1287,1287,1287,1287,1287%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%3D200104%26avms%3Dnio%26qi%3D390493782%26psm%3D3%26psv%3D2%26psfv%3D2%26psa%3D0%26pngs%3D9,14,200104c,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1,fmd%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,1287;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.01%26t%3D1703679070210;ecn1=1;etm1=0;eid1=960584;

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS