earnme.club Open in urlscan Pro
157.90.71.190 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://earnme.club/nord-n1-from-oneplus/
Submission Tags: socgholish parrottds ndsx/ndsw Search All
Submission: On April 30 via api (April 30th 2023, 3:15:31 pm UTC) from US — Scanned from DE

Summary HTTP 374 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 84 IPs in 9 countries across 63 domains to perform 374 HTTP transactions. The main IP is 157.90.71.190, located in Germany and belongs to HETZNER-AS, DE. The main domain is earnme.club.
TLS certificate: Issued by R3 on April 26th 2023. Valid for: 3 months.

This is the only time earnme.club was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
16	157.90.71.190 157.90.71.190	24940 (HETZNER-AS) (HETZNER-AS)
3	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
1	2606:4700:303... 2606:4700:3038::6815:eab0	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:480... 2a02:26f0:480:25::1726:6211	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
1	2a04:fa87:fff... 2a04:fa87:fffe::c000:4902	2635 (AUTOMATTIC) (AUTOMATTIC)
1	68.183.18.251 68.183.18.251	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2606:4700::68... 2606:4700::6810:85e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	52.222.208.154 52.222.208.154	16509 (AMAZON-02) (AMAZON-02)
2	2a04:4e42::485 2a04:4e42::485	54113 (FASTLY) (FASTLY)
2	2606:4700:440... 2606:4700:4400::6812:220a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.122.46 18.66.122.46	16509 (AMAZON-02) (AMAZON-02)
1 4	37.252.171.21 37.252.171.21	29990 (ASN-APPNEX) (ASN-APPNEX)
1	147.75.84.158 147.75.84.158	54825 (PACKET) (PACKET)
1	52.59.102.99 52.59.102.99	16509 (AMAZON-02) (AMAZON-02)
1	2a02:2638:d::a 2a02:2638:d::a	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	51.89.9.252 51.89.9.252	16276 (OVH) (OVH)
1	104.18.25.185 104.18.25.185	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	34.107.148.139 34.107.148.139	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2602:803:c003... 2602:803:c003:200::51	26667 (RUBICONPR...) (RUBICONPROJECT)
2	69.16.175.10 69.16.175.10	20446 (STACKPATH...) (STACKPATH-CDN)
4	54.159.46.45 54.159.46.45	14618 (AMAZON-AES) (AMAZON-AES)
1	13.32.105.197 13.32.105.197	16509 (AMAZON-02) (AMAZON-02)
1	44.214.59.34 44.214.59.34	14618 (AMAZON-AES) (AMAZON-AES)
2	2620:116:800d... 2620:116:800d:21:e365:4988:e8a7:3270	16509 (AMAZON-02) (AMAZON-02)
2	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
4	35.168.115.78 35.168.115.78	14618 (AMAZON-AES) (AMAZON-AES)
1	23.215.22.18 23.215.22.18	16625 (AKAMAI-AS) (AKAMAI-AS)
2	65.9.66.97 65.9.66.97	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:10:... 2606:4700:10::6816:35ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700:10:... 2606:4700:10::6816:3456	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
5	2400:52e0:1e0... 2400:52e0:1e00::863:1	200325 (BUNNYCDN) (BUNNYCDN)
2	34.195.250.234 34.195.250.234	14618 (AMAZON-AES) (AMAZON-AES)
2 6	2a02:2638:d::d 2a02:2638:d::d	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:1901:0:8... 2600:1901:0:8344::	15169 (GOOGLE) (GOOGLE)
4	2606:4700:10:... 2606:4700:10::6816:445	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	162.19.138.117 162.19.138.117	16276 (OVH) (OVH)
1	52.205.24.151 52.205.24.151	14618 (AMAZON-AES) (AMAZON-AES)
3	34.252.16.161 34.252.16.161	16509 (AMAZON-02) (AMAZON-02)
5	104.111.217.42 104.111.217.42	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a02:26f0:480... 2a02:26f0:480:7b5::2c79	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:9000:223... 2600:9000:223c:fa00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	141.95.33.111 141.95.33.111	16276 (OVH) (OVH)
2	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	34.196.26.133 34.196.26.133	14618 (AMAZON-AES) (AMAZON-AES)
57	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
58	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:225... 2600:9000:2250:3400:a:e047:752:b361	16509 (AMAZON-02) (AMAZON-02)
3	2a02:2638:d::2 2a02:2638:d::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
22	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
2 2	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:806::2006	15169 (GOOGLE) (GOOGLE)
2	35.190.39.111 35.190.39.111	15169 (GOOGLE) (GOOGLE)
1 2	34.120.135.53 34.120.135.53	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2.19.228.187 2.19.228.187	16625 (AKAMAI-AS) (AKAMAI-AS)
3 5	2a00:1450:400... 2a00:1450:4001:80e::2004	15169 (GOOGLE) (GOOGLE)
15	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
4	37.157.5.132 37.157.5.132	198622 (ADFORM) (ADFORM)
7	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1 5	20.101.38.191 20.101.38.191	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	88.221.168.207 88.221.168.207	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	37.252.171.53 37.252.171.53	29990 (ASN-APPNEX) (ASN-APPNEX)
8 9	216.58.212.162 216.58.212.162	15169 (GOOGLE) (GOOGLE)
1	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
1 1	212.82.100.182 212.82.100.182	34010 (YAHOO-IRD) (YAHOO-IRD)
1	3.75.62.37 3.75.62.37	16509 (AMAZON-02) (AMAZON-02)
2 4	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
1	2a00:1450:400... 2a00:1450:4001:810::2001	15169 (GOOGLE) (GOOGLE)
2	178.250.7.13 178.250.7.13	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	40.85.112.191 40.85.112.191	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
6	172.217.23.98 172.217.23.98	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:480... 2a02:26f0:480:9::210:ee05	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	37.157.2.247 37.157.2.247	198622 (ADFORM) (ADFORM)
1	2.18.232.99 2.18.232.99	16625 (AKAMAI-AS) (AKAMAI-AS)
2	34.149.12.213 34.149.12.213	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:224... 2600:9000:2240:9200:8:455e:4a00:93a1	16509 (AMAZON-02) (AMAZON-02)
374	84

16 157.90.71.190 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.190.71.90.157.clients.your-server.de

earnme.club	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3038::6815:eab0 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.adapex.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:25::1726:6211 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

tg1.playstream.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

adncdnend.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)

secure.gravatar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.183.18.251 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: capture2.analytics.hbwrapper

cat2.hbwrapper.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:85e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.222.208.154 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-208-154.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:4400::6812:220a (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.confiant-integrations.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.46 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-46.fra60.r.cloudfront.net

p.gcprivacy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.252.171.21 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.75.84.158 (Schiphol, Netherlands)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.59.102.99 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-59-102-99.eu-central-1.compute.amazonaws.com

grid.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:d::a (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.89.9.252 (London, United Kingdom)

ASN16276 (OVH, FR)
PTR: ip252.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.25.185 (None, )

ASN13335 (CLOUDFLARENET, US)

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.244.159.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

digikulture-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.107.148.139 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 139.148.107.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2602:803:c003:200::51 (Amsterdam, Netherlands)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.16.175.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: tlb.hwcdn.net

player.avplayer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.159.46.45 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-159-46-45.compute-1.amazonaws.com

track1.aniview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.105.197 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-105-197.fra60.r.cloudfront.net

aax.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 44.214.59.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-214-59-34.compute-1.amazonaws.com

p2.gcprivacy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:e365:4988:e8a7:3270 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

c.neodatagroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.168.115.78 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-168-115-78.compute-1.amazonaws.com

prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.215.22.18 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-215-22-18.deploy.static.akamaitechnologies.com

secure.cdn.fastclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.66.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-97.fra56.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:35ad (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.hadronid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:3456 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2400:52e0:1e00::863:1 (Germany)

ASN200325 (BUNNYCDN, SI)

cdn.playstream.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
streaming.playstream.media	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.195.250.234 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-195-250-234.compute-1.amazonaws.com

track1.avplayer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:2638:d::d (France) 2 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1901:0:8344:: (Kansas City, United States)

ASN15169 (GOOGLE, US)

lexicon.33across.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:10::6816:445 (United States)

ASN13335 (CLOUDFLARENET, US)

id.hadron.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.ad.gt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 162.19.138.117 (France)

ASN16276 (OVH, FR)
PTR: ns31533568.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.205.24.151 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-24-151.compute-1.amazonaws.com

idx.liadm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.252.16.161 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-16-161.eu-west-1.compute.amazonaws.com

id.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.111.217.42 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-217-42.deploy.static.akamaitechnologies.com

at.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:7b5::2c79 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

player.aniview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:fa00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 141.95.33.111 (Germany)

ASN16276 (OVH, FR)
PTR: ns3203177.ip-141-95-33.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.196.26.133 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-196-26-133.compute-1.amazonaws.com

go1.aniview.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

57 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

58 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:3400:a:e047:752:b361 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:2638:d::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.70 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:806::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.39.111 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.135.53 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 53.135.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.228.187 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-228-187.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany) 3 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.157.5.132 (Denmark)

ASN198622 (ADFORM, DK)

track.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 20.101.38.191 (Amsterdam, Netherlands) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

tra.neodatagroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tracker.neodatagroup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 88.221.168.207 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a88-221-168-207.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.252.171.53 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 216.58.212.162 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: ams15s22-in-f162.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.33.220.150 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.182 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)
PTR: spcms.pbp.vip.ir2.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.75.62.37 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.80.39.216 (Canada) 2 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

lh4.googleusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.7.13 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.85.112.191 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.youronlinechoices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.23.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s45-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:9::210:ee05 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 37.157.2.247 (Denmark)

ASN198622 (ADFORM, DK)

s1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.99 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-99.deploy.static.akamaitechnologies.com

cdn.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.149.12.213 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 213.12.149.34.bc.googleusercontent.com

rtb0.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rtbc-eu3.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2240:9200:8:455e:4a00:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.besafe.global	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
123	googlesyndication.com 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 129 tpc.googlesyndication.com — Cisco Umbrella Rank: 177	986 KB
47	doubleclick.net 10 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 269 ad.doubleclick.net — Cisco Umbrella Rank: 201 googleads.g.doubleclick.net — Cisco Umbrella Rank: 67 cm.g.doubleclick.net — Cisco Umbrella Rank: 313 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 394	491 KB
22	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 322	468 KB
16	earnme.club earnme.club	191 KB
15	adform.net track.adform.net — Cisco Umbrella Rank: 3229 s1.adform.net — Cisco Umbrella Rank: 7269	148 KB
9	criteo.com 2 redirects bidder.criteo.com — Cisco Umbrella Rank: 803 gum.criteo.com — Cisco Umbrella Rank: 442 mug.criteo.com — Cisco Umbrella Rank: 1686	15 KB
8	openx.net 1 redirects digikulture-d.openx.net — Cisco Umbrella Rank: 39846 oajs.openx.net — Cisco Umbrella Rank: 3166 google-bidout-d.openx.net — Cisco Umbrella Rank: 3148 us-u.openx.net — Cisco Umbrella Rank: 707	1 KB
7	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 238	340 KB
7	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 1319 id5-sync.com — Cisco Umbrella Rank: 612	37 KB
7	neodatagroup.com 1 redirects c.neodatagroup.com — Cisco Umbrella Rank: 36186 tra.neodatagroup.com — Cisco Umbrella Rank: 35833 tracker.neodatagroup.com — Cisco Umbrella Rank: 35132	16 KB
6	mathtag.com pixel.mathtag.com — Cisco Umbrella Rank: 1405	5 KB
6	google.com 3 redirects adservice.google.com — Cisco Umbrella Rank: 130 www.google.com — Cisco Umbrella Rank: 16	1 KB
6	aniview.com track1.aniview.com — Cisco Umbrella Rank: 2704 player.aniview.com — Cisco Umbrella Rank: 2816 go1.aniview.com — Cisco Umbrella Rank: 7142	128 KB
6	playstream.media tg1.playstream.media — Cisco Umbrella Rank: 67824 cdn.playstream.media — Cisco Umbrella Rank: 101352 streaming.playstream.media — Cisco Umbrella Rank: 77749	1 MB
5	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 373	75 KB
5	teads.tv at.teads.tv — Cisco Umbrella Rank: 4942 sync.teads.tv — Cisco Umbrella Rank: 1703	1022 B
5	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1550 id.crwdcntrl.net — Cisco Umbrella Rank: 2256 bcp.crwdcntrl.net — Cisco Umbrella Rank: 1323	24 KB
5	casalemedia.com 2 redirects htlb.casalemedia.com — Cisco Umbrella Rank: 768 dsum-sec.casalemedia.com — Cisco Umbrella Rank: 876	4 KB
5	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 319 secure.adnxs.com — Cisco Umbrella Rank: 604	5 KB
5	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 361 aax.amazon-adsystem.com — Cisco Umbrella Rank: 455	64 KB
5	gstatic.com fonts.gstatic.com www.gstatic.com	41 KB
5	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 114	303 KB
4	doubleverify.com cdn.doubleverify.com — Cisco Umbrella Rank: 672 rtb0.doubleverify.com — Cisco Umbrella Rank: 1069 rtbc-eu3.doubleverify.com — Cisco Umbrella Rank: 20299	21 KB
4	ad.gt id.hadron.ad.gt — Cisco Umbrella Rank: 4186 a.ad.gt — Cisco Umbrella Rank: 4166	4 KB
4	amazon.dev prod.us-east-1.cxm-bcn.publisher-services.amazon.dev — Cisco Umbrella Rank: 1019	915 B
4	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 1718 www.google-analytics.com — Cisco Umbrella Rank: 91	21 KB
4	avplayer.com player.avplayer.com — Cisco Umbrella Rank: 14855 track1.avplayer.com — Cisco Umbrella Rank: 18300	131 KB
3	criteo.net static.criteo.net — Cisco Umbrella Rank: 763	71 KB
3	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 1293	1 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 119	3 KB
2	yahoo.com 1 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 1606 ups.analytics.yahoo.com — Cisco Umbrella Rank: 402	862 B
2	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 4649	335 B
2	hadronid.net cdn.hadronid.net — Cisco Umbrella Rank: 3273	19 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 1478 pixel.quantserve.com — Cisco Umbrella Rank: 1327	9 KB
2	rubiconproject.com fastlane.rubiconproject.com — Cisco Umbrella Rank: 677	2 KB
2	gcprivacy.com p.gcprivacy.com — Cisco Umbrella Rank: 35669 p2.gcprivacy.com — Cisco Umbrella Rank: 30204	10 KB
2	confiant-integrations.net cdn.confiant-integrations.net — Cisco Umbrella Rank: 1925	104 KB
2	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 474	2 KB
1	besafe.global cdn.besafe.global — Cisco Umbrella Rank: 31492	37 KB
1	flashtalking.com cdn.flashtalking.com — Cisco Umbrella Rank: 1641	23 KB
1	youronlinechoices.com www.youronlinechoices.com — Cisco Umbrella Rank: 109186
1	googleusercontent.com lh4.googleusercontent.com — Cisco Umbrella Rank: 1205	179 KB
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 451	265 B
1	pubmatic.com ads.pubmatic.com — Cisco Umbrella Rank: 725	63 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 3353	8 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 3991	2 KB
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 4083	2 KB
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1291	634 B
1	liadm.com idx.liadm.com — Cisco Umbrella Rank: 3099	426 B
1	33across.com lexicon.33across.com — Cisco Umbrella Rank: 1915	247 B
1	google.de adservice.google.de — Cisco Umbrella Rank: 5261	531 B
1	fastclick.net secure.cdn.fastclick.net — Cisco Umbrella Rank: 1680	17 KB
1	media.net prebid.media.net — Cisco Umbrella Rank: 1912	1 KB
1	onetag-sys.com onetag-sys.com — Cisco Umbrella Rank: 1124	359 B
1	bidswitch.net grid.bidswitch.net — Cisco Umbrella Rank: 1416	237 B
1	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 1379	167 B
1	cloudflare.com cloudflare.com — Cisco Umbrella Rank: 163	456 B
1	hbwrapper.com cat2.hbwrapper.com — Cisco Umbrella Rank: 30705	256 B
1	gravatar.com secure.gravatar.com — Cisco Umbrella Rank: 2802	1 KB
1	azureedge.net adncdnend.azureedge.net — Cisco Umbrella Rank: 56346	3 KB
1	adapex.io cdn.adapex.io — Cisco Umbrella Rank: 36293	170 KB
0	rlcdn.com Failed api.rlcdn.com Failed
0	agkn.com Failed fid.agkn.com Failed
374	63

	Domain	Requested by
58	tpc.googlesyndication.com	securepubads.g.doubleclick.net earnme.club 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com tpc.googlesyndication.com cdn.ampproject.org googleads.g.doubleclick.net
57	pagead2.googlesyndication.com	securepubads.g.doubleclick.net 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com earnme.club pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
22	cdn.ampproject.org	securepubads.g.doubleclick.net
16	earnme.club	earnme.club
15	googleads.g.doubleclick.net	4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com earnme.club pagead2.googlesyndication.com
15	securepubads.g.doubleclick.net	earnme.club securepubads.g.doubleclick.net
11	s1.adform.net	earnme.club track.adform.net s1.adform.net
9	cm.g.doubleclick.net	8 redirects googleads.g.doubleclick.net
8	4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
7	www.googletagservices.com	4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com earnme.club
6	googleads4.g.doubleclick.net	googleads.g.doubleclick.net
6	pixel.mathtag.com	c.neodatagroup.com pixel.mathtag.com
6	gum.criteo.com	2 redirects cdn.adapex.io static.criteo.net
5	www.google.com	3 redirects earnme.club tpc.googlesyndication.com
5	s0.2mdn.net	earnme.club 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
5	id5-sync.com	cdn.adapex.io cdn.id5-sync.com
5	www.googletagmanager.com	earnme.club cdn.adapex.io www.googletagmanager.com adncdnend.azureedge.net
4	sync.teads.tv	googleads.g.doubleclick.net
4	us-u.openx.net	googleads.g.doubleclick.net
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	track.adform.net	4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com earnme.club s1.adform.net
4	streaming.playstream.media	player.avplayer.com
4	prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	c.amazon-adsystem.com
4	track1.aniview.com	earnme.club player.aniview.com
4	ib.adnxs.com	1 redirects cdn.adapex.io googleads.g.doubleclick.net
4	c.amazon-adsystem.com	cdn.adapex.io c.amazon-adsystem.com
3	tra.neodatagroup.com	1 redirects
3	www.gstatic.com	earnme.club 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
3	static.criteo.net	securepubads.g.doubleclick.net cdn.adapex.io static.criteo.net
3	lb.eu-1-id5-sync.com	cdn.id5-sync.com cdn.adapex.io
3	id.hadron.ad.gt	cdn.adapex.io cdn.hadronid.net
3	fonts.googleapis.com	earnme.club 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
2	cdn.doubleverify.com	4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com cdn.doubleverify.com
2	mug.criteo.com
2	tracker.neodatagroup.com
2	oajs.openx.net	1 redirects
2	esp.rtbhouse.com	invstatic101.creativecdn.com
2	ad.doubleclick.net	2 redirects
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	bcp.crwdcntrl.net	tags.crwdcntrl.net
2	track1.avplayer.com	earnme.club
2	cdn.id5-sync.com	earnme.club securepubads.g.doubleclick.net
2	cdn.hadronid.net	earnme.club
2	tags.crwdcntrl.net	earnme.club securepubads.g.doubleclick.net
2	region1.google-analytics.com	www.googletagmanager.com
2	c.neodatagroup.com	earnme.club c.neodatagroup.com
2	player.avplayer.com	tg1.playstream.media player.avplayer.com
2	fastlane.rubiconproject.com	cdn.adapex.io
2	cdn.confiant-integrations.net	adncdnend.azureedge.net cdn.confiant-integrations.net
2	cdn.jsdelivr.net	cdn.adapex.io securepubads.g.doubleclick.net
2	fonts.gstatic.com	fonts.googleapis.com
1	cdn.besafe.global	4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
1	rtbc-eu3.doubleverify.com	cdn.doubleverify.com
1	rtb0.doubleverify.com	cdn.doubleverify.com
1	cdn.flashtalking.com	track.adform.net
1	www.youronlinechoices.com
1	google-bidout-d.openx.net	oa.openxcdn.net
1	lh4.googleusercontent.com	4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
1	ups.analytics.yahoo.com
1	cms.analytics.yahoo.com	1 redirects
1	match.adsrvr.org
1	secure.adnxs.com	1 redirects
1	ads.pubmatic.com	player.aniview.com
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	a.ad.gt	cdn.hadronid.net
1	go1.aniview.com	player.aniview.com
1	pixel.quantserve.com	earnme.club
1	rules.quantcount.com	secure.quantserve.com
1	player.aniview.com	player.avplayer.com
1	at.teads.tv	cdn.adapex.io
1	id.crwdcntrl.net	cdn.adapex.io
1	idx.liadm.com	cdn.adapex.io
1	lexicon.33across.com	cdn.adapex.io
1	cdn.playstream.media	earnme.club
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	secure.cdn.fastclick.net	earnme.club
1	secure.quantserve.com	www.googletagmanager.com
1	p2.gcprivacy.com	p.gcprivacy.com
1	aax.amazon-adsystem.com	c.amazon-adsystem.com
1	prebid.media.net	cdn.adapex.io
1	digikulture-d.openx.net	cdn.adapex.io
1	htlb.casalemedia.com	cdn.adapex.io
1	onetag-sys.com	cdn.adapex.io
1	bidder.criteo.com	cdn.adapex.io
1	grid.bidswitch.net	cdn.adapex.io
1	prebid.a-mo.net	cdn.adapex.io
1	p.gcprivacy.com	cdn.adapex.io
1	cloudflare.com	cdn.adapex.io
1	cat2.hbwrapper.com	cdn.adapex.io
1	secure.gravatar.com	earnme.club
1	adncdnend.azureedge.net	earnme.club
1	tg1.playstream.media	earnme.club
1	cdn.adapex.io	earnme.club
0	api.rlcdn.com Failed	cdn.adapex.io
0	fid.agkn.com Failed	cdn.adapex.io
374	98

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
t.me
api.whatsapp.com

Subject Issuer	Validity	Valid
www.usanewstoday.tnlink.in R3	`2023-04-26` - `2023-07-25`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
wl.aniview.com R3	`2023-04-29` - `2023-07-28`	3 months	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2022-07-11` - `2023-07-11`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.gravatar.com Sectigo ECC Domain Validation Secure Server CA	`2022-11-23` - `2023-12-24`	a year	crt.sh
cat2.hbwrapper.com R3	`2023-03-06` - `2023-06-04`	3 months	crt.sh
cloudflare.com Cloudflare Inc ECC CA-3	`2023-04-07` - `2023-07-06`	3 months	crt.sh
c.amazon-adsystem.com Amazon RSA 2048 M01	`2023-02-28` - `2024-02-17`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4	`2022-12-23` - `2024-01-24`	a year	crt.sh
*.confiant-integrations.net GTS CA 1P5	`2023-03-27` - `2023-06-25`	3 months	crt.sh
*.gcprivacy.com Amazon RSA 2048 M01	`2023-02-23` - `2024-01-01`	10 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.a-mo.net R3	`2023-04-13` - `2023-07-12`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-09` - `2023-06-03`	3 months	crt.sh
*.onetag-sys.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-12-28` - `2024-01-28`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.media.net Sectigo RSA Domain Validation Secure Server CA	`2022-04-06` - `2023-05-04`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.avplayer.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2022-08-08` - `2023-09-08`	a year	crt.sh
*.aniview.com Amazon RSA 2048 M01	`2023-02-21` - `2024-01-04`	10 months	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
sni8045gl.wpc.edgecastcdn.net DigiCert TLS RSA SHA256 2020 CA1	`2022-11-08` - `2023-12-09`	a year	crt.sh
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev Amazon RSA 2048 M02	`2022-12-27` - `2024-01-25`	a year	crt.sh
secure.cdn.fastclick.net DigiCert TLS RSA SHA256 2020 CA1	`2022-12-02` - `2023-12-02`	a year	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
*.hadronid.net GTS CA 1P5	`2023-04-11` - `2023-07-10`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
cdn.playstream.media R3	`2023-03-29` - `2023-06-27`	3 months	crt.sh
lexicon.33across.com GTS CA 1D4	`2023-04-13` - `2023-07-12`	3 months	crt.sh
*.id5-sync.com R3	`2023-04-18` - `2023-07-17`	3 months	crt.sh
*.liadm.com Amazon RSA 2048 M01	`2023-02-21` - `2023-10-29`	8 months	crt.sh
teads.tv R3	`2023-02-21` - `2023-05-22`	3 months	crt.sh
quantserve.com R3	`2023-04-14` - `2023-07-13`	3 months	crt.sh
*.eu-1-id5-sync.com R3	`2023-04-18` - `2023-07-17`	3 months	crt.sh
streaming.playstream.media R3	`2023-03-29` - `2023-06-27`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
invstatic101.creativecdn.com GTS CA 1D4	`2023-04-28` - `2023-07-28`	3 months	crt.sh
cdn.prod.uidapi.com R3	`2023-02-25` - `2023-05-26`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-24` - `2023-06-18`	3 months	crt.sh
oa.openxcdn.net GTS CA 1D4	`2023-03-30` - `2023-06-28`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
esp.rtbhouse.com GTS CA 1D4	`2023-03-20` - `2023-06-18`	3 months	crt.sh
*.pubmatic.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-25` - `2024-01-24`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
track.adform.net DigiCert TLS RSA SHA256 2020 CA1	`2022-09-20` - `2023-09-20`	a year	crt.sh
pixel.mathtag.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-05` - `2023-07-05`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
*.googleusercontent.com GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-04-03` - `2023-06-26`	3 months	crt.sh
youronlinechoices.com Go Daddy Secure Certificate Authority - G2	`2022-07-02` - `2023-08-03`	a year	crt.sh
*.doubleverify.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-05` - `2023-07-07`	a year	crt.sh
cdn.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-20` - `2023-05-20`	a year	crt.sh
cdn.besafe.global Amazon RSA 2048 M01	`2023-04-26` - `2024-05-24`	a year	crt.sh
neodatagroup.com R3	`2023-04-11` - `2023-07-10`	3 months	crt.sh

This page contains 36 frames:

Primary Page: https://earnme.club/nord-n1-from-oneplus/
Frame ID: 3FCB5556117FFA6DF4854365F31AD0D2
Requests: 145 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: CBFE7AF1672383D8B2D3B37CE31AE7B6
Requests: 1 HTTP requests in this frame

Frame: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=62176a72a06fe80ba569d18f
Frame ID: 42241154DE16A8B0E503A2E49E3FCCC1
Requests: 3 HTTP requests in this frame

Frame: https://c.neodatagroup.com/ps-topics.html?sid=2033
Frame ID: 0E176D7135D1F44FBD350FACBAF2EB7B
Requests: 1 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs
Frame ID: 7AA0EE0534DF3E858082666DBD8069F0
Requests: 13 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs
Frame ID: 9E0B21382D28E735DA5D9F4EA6F64EEF
Requests: 15 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 505F3D7505D618F8232C9C0BCD83D7EE
Requests: 16 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D9F1E467F3D4064FFBA71B1FB0EF066E
Requests: 12 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 5627168D827DA798F165616E4DEBC91C
Requests: 18 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: B36FDFCE39EE73DE5C8FE3C6B209E5C5
Requests: 1 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 6AC78E228FEEA6990B3FADE90C807FAB
Requests: 5 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs
Frame ID: 27D5A9A0974357BC837E60D539856D38
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhD7ppe5BBjervHlATAB&v=APEucNVa2pyaWO3xv4isa7tlmJRXBdQpQYwiNYfOXfE8msvMQeOHSrXBhWRrf44amoWMTlfGmMGF7hRTfP9kk4frBV-bfw4BEMhAV-ILPITdsFxxdc6kWtqplqtbKIoIp44E8QJY4CDfVGFGvsVc556Fqm2NcjFRWwLNN8ntYJyKBf-jLdCFTUJf4ugLE01B3P-bTTPdQ-AUhveSVpgZ9d8SGJzeC85Iag
Frame ID: 867DD7CF3B7A1DD2AF5069E5CE9F298D
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXkFSf0xnpW0ZN9oY76Cj76jRpxTD1UmqZ0eLAvfBJ9esxbikZzuBUumPmTGtt1Rqx_Cl_oNckqZOLn9BpwuqRPDcvgEw
Frame ID: 0BF009B5194A426235A833C8B11677A9
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiP9b7cATAB&v=APEucNWO8Nk28T-gnxtCm-BJEsBLnhT2URZ89cliUr_-Qmz5vWlnG7RHQZnEn-0GGZbJlMZFPUfXd7tRsxpHv5fB56oB2on6iQ
Frame ID: A558FA4A79124664D7F215907A005BC0
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Frame ID: 822FA78B68018BDCC774A02EED5D5E7F
Requests: 18 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: 0697E50E0860BD2C80A74B7BC71E3EB2
Requests: 7 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/022304132133000/amp4ads-v0.mjs
Frame ID: 1EF0A146B8BAB5FA0C0B18D54582CEE6
Requests: 16 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=earnme.club
Frame ID: 7FC0623F027347707A8CB1B4CF9837DD
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 9D71604ED56B53B022CA72A71014FC71
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: FB1A3EC903E7E22C335D666E147DE9F4
Requests: 2 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 175DC28CF0E5D720CE53E377F8E7492E
Requests: 1 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 8B82B279676B247469D57F927A3053C4
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 85916CC55ACE76D391E4C265F0ACFC77
Requests: 2 HTTP requests in this frame

Frame: https://pixel.mathtag.com/sync/iframe?mt_uuid=3069644e-860c-4b00-9b14-7db1a0fa86b9&no_iframe=1&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370&mt_exid=10082&source=mathtag
Frame ID: 960E2DA14F5EC357D7B3E6FD5DB3F3AD
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js
Frame ID: C0278DBA937E97262AF264EC0C64FF0A
Requests: 1 HTTP requests in this frame

Frame: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 5A852DDF3A399F4A69689EF189B86EDD
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXUw2X1UlVUXa4ZBCXo1OsbWZj7ODO6QUay7wkkzxflTwGTa3IfrLcd7HLYzfeobGpAV6ZKuTQwN-4ZkrdoVD3N2GrmORpi1yan3CbbrK5dNHesCW6ZcR73PnYb57tOtZ1xu0JoKQaRySNXX399FzrBTQ94ydnOt9OKSzPt-TO1p5-SEdTPQcEMRdy-5cxHi1jnZ3TuusJiJ-lv88HDe8qdtfBREA
Frame ID: 8DF2BE2BB373AC9F49595A5BB3D4C570
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJDi1MQCENjdsOICGM6PneYBMAE&v=APEucNXM8cUhMtSDsRWv_NxOqssVQCR7El012B5ESMDqpBaiPgsKJ5MFP_gazJ_mVa3zKqqXrE_KWphuaFDPcpmZgY3656FllIKA5HL3HOsGRBYoUu0ygYxSXXcr6U5SUXjsuXgXzAnruutUVXAuUY7Z8G2qoDoD_ahtj85eHj5egMnssZeitWsdZ9b7wvSo75LMXSjRgoE7dA6GbAGlgyfLXER4HLo8qg
Frame ID: C516C80AD6F100153E7C77909C0E1173
Requests: 5 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertag&topUrl=earnme.club
Frame ID: 2388395A11B297C3BED48D63582249CB
Requests: 2 HTTP requests in this frame

Frame: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Frame ID: 1BBAE08EDF032798E2E3FFCFCFD74B46
Requests: 14 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: E1086FECD984A877B7AA7301D3D2C3E7
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A2E73E80DE062EC3DF5222288FAEEB29
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 902067589F647F83C13A2A6A4719216F
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 81844B4FD82ED1A98F876A6FF4978565
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 806EF669BD1AA4B78F84E33CB2717A68
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

NORD N1 from ONEPLUS – Tech News

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

tpc\.googlesyndication\.com/safeframe

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

374
Requests

94 %
HTTPS

47 %
IPv6

63
Domains

98
Subdomains

84
IPs

9
Countries

5298 kB
Transfer

12620 kB
Size

41
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F

Search URL Search Domain Scan URL

URL: https://twitter.com/share?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&text=NORD%20N1%20from%20ONEPLUS

Search URL Search Domain Scan URL

URL: https://t.me/share/url?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&text=NORD%20N1%20from%20ONEPLUS

Search URL Search Domain Scan URL

URL: https://api.whatsapp.com/send?text=NORD%20N1%20from%20ONEPLUS%20https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 143

https://ad.doubleclick.net/ddm/ad/N4789.Google/B21030944.360656933;sz=1x1;ord=3265447473;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= HTTP 302
https://ad.doubleclick.net/ddm/ad/N4789.Google/B21030944.360656933;dc_pre=CMzt_-by0f4CFRXjuwgd-FwAgQ;sz=1x1;ord=3265447473;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent= HTTP 302
https://s0.2mdn.net/simgad/5741634688953437709

Request Chain 149

https://oajs.openx.net/esp?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&rid=esp&cc=1

Request Chain 240

https://tra.neodatagroup.com/pv?sid=2033&rnd=1324546367370&id=11931&ad=122499&rs=1600x1200&lg=en-US&tz=0&ur=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&re=&co=24&cb=window._exaudiadapex.setNeoIdLastSync(%27@@neo_user_id@@%27);&pbs=true HTTP 302
https://tra.neodatagroup.com/pv?sid=2033&rnd=1324546367370&id=11931&ad=122499&rs=1600x1200&lg=en-US&tz=0&ur=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&re=&co=24&cb=window._exaudiadapex.setNeoIdLastSync(%27@@neo_user_id@@%27);&pbs=true&neoid=30fa5773f9005dd

Request Chain 242

https://secure.adnxs.com/getuid?https://tracker.neodatagroup.com/cm?sid=1&pv=APN&eid=$UID&rt=img&rnd=1324546367370 HTTP 302
https://tracker.neodatagroup.com/cm?sid=1&pv=APN&eid=1876879530974592077&rt=img&rnd=1324546367370

Request Chain 243

https://cm.g.doubleclick.net/pixel?google_nid=neodata_dmp&google_cm&pv=dbm&sid=1&rt=img&rnd=1324546367370 HTTP 302
https://tracker.neodatagroup.com/cm?pv=dbm&sid=1&rt=img&rnd=1324546367370&google_gid=CAESEDpDtGnNTkibeOT2bO2_oPk&google_cver=1

Request Chain 245

https://cms.analytics.yahoo.com/cms?partner_id=NDATA&rt=img&rnd=1324546367370 HTTP 302
https://ups.analytics.yahoo.com/ups/58681/cms?partner_id=NDATA&rt=img&rnd=1324546367370

Request Chain 246

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1

Request Chain 247

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZE6GDJ-Pi64HlRl2nlTPeAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1

Request Chain 248

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEIgvsSD80rFV30_a1nnzKRk&google_cver=1

Request Chain 249

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTg3Njg3OTUzMDk3NDU5MjA3Nw%3D%3D

Request Chain 250

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 251

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 254

https://gum.criteo.com/sid/json?origin=publishertagids&domain=earnme.club&sn=ChromeSyncframe&so=0&topUrl=earnme.club&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=iZLea3xlam5GY1BtMXdMWXJQR1lySTVXVStWcVBZTXlMOG00M3hKcEtqYzFRYlZDckExL1Vpd3Z4Z1hqQU9LRmVwcjRCYjYvdEN1TEFIWFpKUnY4blI0UmtVMlQ2RWYwRzErOGZBYzhnQ2dEWWhHZU1UNzJDY0hmL2IrcVZPVG5nYWV1aHJtMzVJNHBjRTBreFl4TDlxVmhaUFJyL3NieW1ydGM4K2pTU0RRcmc0eDBUelc3aTMxL2FLWFpHaERGS2ZNY1FxVFhzSHBVUkJiZTRsL0FzTWFubTVJM1JoenIxcjRmLzdOeVc2TlJIUmZUdUw0U1lOdWNlcXM3R2gzUys3cjdxbE1HQ2N5NW1PZDVaUzBydnNLUTN4Zz09fA&cppv=2

Request Chain 318

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1

Request Chain 320

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1

Request Chain 322

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1

Request Chain 324

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1

Request Chain 326

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 337

https://gum.criteo.com/sid/json?origin=publishertag&domain=earnme.club&sn=ChromeSyncframe&so=3&topUrl=earnme.club&bundle=Q_bN9l8yZ3VLb3RvRUd5MHJpNiUyQmsxZTVQRFhidWVwSjltU2glMkJmaFZhYyUyRlZUTlpCcDdySHFvYW9tMTkwcmttS2tmZEd1ZSUyQmFibWFTQjZrZTBxa1QxZ2xSTXJFQTdpMGF3WEtqNm8lMkJOdnpoTnVLaXJTTGVzRFV6MkJ5eGl0QWR2ZDRya3E5cHNQRW1RRSUyQkV5dXBkSDNuaThEYUElM0QlM0Q&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=v7slG3xsa3A5VVZqODZmUklNcm95eFY5ai9xNkVnSm9KZk9ZdlZjY25SWmtuNVdUM1ZpamQrczR5d0NxSXgvRnRWVERXcGxGYmZxYlB4bEVmdEJaazd4d2FLbjJzYXA5L1hLQ1ZyYUxRd2JBN3AxMldXY3I0bmZkSkMwV3FXLzNyeVR6Y0ROYit4Vkk1UmpXTFFtdURqWjJLUXNzMHNzcTZGTVBWV0g5MUp3czRXeGtQZk1LRlYwNEVVczNwMGVZOGZuZW1yQmZXc1JGTnJsTmZSRHVmTEtMcjBJb0h1akhuTTJablZzeGNuK042VE5hWGZFVDZYT0VUMGRHRnNSRExNeE5GY2tvTmVkVGovaFFaQWN4RlZmbE5lQ2xVYytRNTgxVkJXNSt5NWpRZ09OUT18&cppv=2

374 HTTP transactions
21 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
earnme.club/nord-n1-from-oneplus/ 80 KB
18 KB 771ms
42ms Document
text/html 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 8c3c8a15f532982308c679f9eb63f67c5f66f09e16f375d73da933e7c9dae96f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 30 Apr 2023 15:15:22 GMT
link: <https://earnme.club/wp-json/>; rel="https://api.w.org/" <https://earnme.club/wp-json/wp/v2/posts/65>; rel="alternate"; type="application/json" <https://earnme.club/?p=65>; rel=shortlink
vary: Accept-Encoding
x-pingback: https://earnme.club/xmlrpc.php

GET
H2 200 style.min.css
earnme.club/wp-includes/css/dist/block-library/ 95 KB
12 KB 18ms
15ms Stylesheet
text/css 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-includes/css/dist/block-library/style.min.css?ver=6.2
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Wed, 29 Mar 2023 19:19:23 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 11775
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H2 200 classic-themes.min.css
earnme.club/wp-includes/css/ 291 B
219 B 16ms
14ms Stylesheet
text/css 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-includes/css/classic-themes.min.css?ver=6.2
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Wed, 29 Mar 2023 19:19:23 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 164
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 126ms
45ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro%3Aregular%2Citalic%2C700%2C300%26subset%3Dlatin%2C&ver=1.3.4

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e5b5a916b59197e47395f7d4551e2b22ca1edb4aab399391054903d5d70b41d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 15:06:45 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 30 Apr 2023 15:15:22 GMT

GET
H2 200 style.css
earnme.club/wp-content/themes/bloggingpro/ 67 KB
13 KB 14ms
12ms Stylesheet
text/css 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-content/themes/bloggingpro/style.css?ver=1.3.4
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 032ee610899049b073fdf790620af5864399548b06ac91cd2e57114ef45baa8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Sun, 01 Jan 2023 07:20:09 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 13560
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H2 200 aaw.emc.js Show response
cdn.adapex.io/hb/ 565 KB
170 KB 73ms
31ms Script
application/javascript 2606:4700:3038::6815:eab0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adapex.io/hb/aaw.emc.js
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3038::6815:eab0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8eaff8cf583969b5a13ec6f821a48a3c8d2c3ca768997ddfd551207a2e90e7e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 31252
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Tue, 25 Apr 2023 05:55:46 GMT
server: cloudflare
etag: W/"64476b62-8d447"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8CFoWzVk%2FCCd6NgRJkBR0nI06fAwTz1bgJKlWVJCxgiGD%2BG7VrDMF0f943KAhFCSO%2Fhl0NYctD%2FysqyL9eX1oBbiCxDHHNw2%2Fu%2FPFFnERMPW3x%2B3Nz1I9rAe8%2BBBnUJbqndjFTXJZxOde1hc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
cf-ray: 7c00bd600abd9b80-FRA
expires: Sun, 30 Apr 2023 17:46:49 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 74 KB
25 KB 220ms
111ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bef46c43f3efdb52f757d5c26af73901453eb3cf1396ba163f63bf9d6e950f00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24757
x-xss-protection: 0
server: cafe
etag: 426 / 19477 / m202304250101 / config-hash: 17856767610576847833
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:22 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 221 KB
77 KB 214ms
129ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LY1N2M6E7Y

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7ffb78034d200f0e666ca72ddd3c94c3c5e54d6ecbb207470869938e7c3ea591

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79205
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 30 Apr 2023 15:15:22 GMT

GET
H3 200 wp-emoji-release.min.js Show response
earnme.club/wp-includes/js/ 22 KB
6 KB 12ms
12ms Script
application/javascript 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-includes/js/wp-emoji-release.min.js?ver=6.2
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: d9aa165ece71e3d909e4ca104763875a7272f1d4f6d16effe5c4aef9c65c1f50

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Wed, 29 Mar 2023 19:19:23 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 5949
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H/1.1 200
OK spt Show response
tg1.playstream.media/api/adserver/ 30 KB
8 KB 197ms
126ms Script
text/javascript 2a02:26f0:480:25::1726:6211
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://tg1.playstream.media/api/adserver/spt?AV_TAGID=62790805abc41c4450002684&AV_PUBLISHERID=62176a72a06fe80ba569d18f
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:25::1726:6211 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: c8223cc5d11f9c0e7b42bcf713111486f82a8210e703ecd4a4eaef6352683e90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

X-Bamboo-C-SkSt: 1
Content-Encoding: gzip
X-Bamboo-C-SkFe: 1
X-Bamboo-C-S: BYPASS
Date: Sun, 30 Apr 2023 15:15:22 GMT
Access-Control-Max-Age: 1728000
Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS, INDEX
Content-Type: text/javascript
Vary: Accept-Encoding
Cache-Control: max-age=300
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Bamboo-Token,Event-Id,X-Requested-With
Content-Length: 7627
Expires: Sun, 30 Apr 2023 15:20:22 GMT

GET
H3 200 javascript-plugin-min.js Show response
earnme.club/wp-content/themes/bloggingpro/js/ 43 KB
16 KB 12ms
12ms Script
application/javascript 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-content/themes/bloggingpro/js/javascript-plugin-min.js?ver=1.3.4
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 264fb85003051e903c07ed1298a808790999c2d216794f0c232dae31b8677a11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Sun, 01 Jan 2023 07:20:09 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 16158
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 infinite-scroll-custom.js Show response
earnme.club/wp-content/themes/bloggingpro/js/ 27 KB
8 KB 14ms
13ms Script
application/javascript 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-content/themes/bloggingpro/js/infinite-scroll-custom.js?ver=1.3.4
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 03a2b4822453df68a44341f563e92e4c2a9df51ea2e1136b9228dc12a730798a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Sun, 01 Jan 2023 07:20:09 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 8034
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 customscript.js Show response
earnme.club/wp-content/themes/bloggingpro/js/ 11 KB
3 KB 14ms
14ms Script
application/javascript 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-content/themes/bloggingpro/js/customscript.js?ver=1.3.4
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: b6b700d252c39b2d4bdc4b268dea076a3e20181bc4c7c4e8464158c37358856a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Sun, 01 Jan 2023 07:20:09 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3133
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 comment-reply.min.js Show response
earnme.club/wp-includes/js/ 7 KB
3 KB 14ms
13ms Script
application/javascript 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://earnme.club/wp-includes/js/comment-reply.min.js?ver=6.2
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 66d35649a7a52c5dde7a671e4a71fb90bdb91689b77a58c928a8255ea296f067

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
last-modified: Wed, 29 Mar 2023 19:19:23 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2531
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H2 200 earnme.adn.js Show response
adncdnend.azureedge.net/adtags/ 9 KB
3 KB 61ms
7ms Script
text/javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adncdnend.azureedge.net/adtags/earnme.adn.js
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CE6) /
Resource Hash: 29765a09ee703903afb30267b14007723160a607780b879e6eb0e9d8692f6b78

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
content-md5: qSoQQzrH2m0W5o3/OR/IpQ==
age: 70043
x-cache: HIT
content-length: 2682
x-ms-lease-status: unlocked
last-modified: Mon, 24 Apr 2023 06:52:50 GMT
server: ECAcc (frc/4CE6)
etag: 0x8DB449085122355
vary: Accept-Encoding
content-type: text/javascript
x-ms-request-id: ffee0b7b-401e-007f-3ad3-7ac7c6000000
cache-control: max-age=86400
x-ms-version: 2009-09-19
expires: Mon, 01 May 2023 15:15:22 GMT

GET
H3 200 /
earnme.club/nord-n1-from-oneplus/ 80 KB
80 KB 38ms
38ms Image
text/html 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://earnme.club/nord-n1-from-oneplus/
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
link: <https://earnme.club/wp-json/>; rel="https://api.w.org/", <https://earnme.club/wp-json/wp/v2/posts/65>; rel="alternate"; type="application/json", <https://earnme.club/?p=65>; rel=shortlink
x-pingback: https://earnme.club/xmlrpc.php
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ 13 KB
13 KB 117ms
38ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro%3Aregular%2Citalic%2C700%2C300%26subset%3Dlatin%2C&ver=1.3.4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://earnme.club
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 04:00:36 GMT
x-content-type-options: nosniff
age: 213286
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Apr 2024 04:00:36 GMT

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ 13 KB
13 KB 124ms
45ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro%3Aregular%2Citalic%2C700%2C300%26subset%3Dlatin%2C&ver=1.3.4

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://earnme.club
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 00:16:43 GMT
x-content-type-options: nosniff
age: 140319
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12924
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:02:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Apr 2024 00:16:43 GMT

GET
H2 200 ce2e698c2ff496a6f5158d5390376c88
secure.gravatar.com/avatar/ 969 B
1 KB 33ms
7ms Image
image/jpeg 2a04:fa87:fffe::c000:4902
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure.gravatar.com/avatar/ce2e698c2ff496a6f5158d5390376c88?s=40&d=mm&r=g
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: dc15ed14c23ce1a976a7306db458305071c0a119026ecff8be8536f28684e391

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Sun, 30 Apr 2023 15:15:22 GMT
last-modified: Wed, 11 Jan 1984 08:00:00 GMT
server: nginx
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=300
content-disposition: inline; filename="ce2e698c2ff496a6f5158d5390376c88.png"
accept-ranges: bytes
link: <https://www.gravatar.com/avatar/ce2e698c2ff496a6f5158d5390376c88?s=40&d=mm&r=g>; rel="canonical"
content-length: 969
expires: Sun, 30 Apr 2023 15:20:22 GMT

GET
H3 200 maxresdefault-7-200x112.jpg
earnme.club/wp-content/uploads/2023/02/ 6 KB
6 KB 13ms
12ms Image
image/jpeg 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://earnme.club/wp-content/uploads/2023/02/maxresdefault-7-200x112.jpg
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 4ddf2e75347d5280d7a42f0db3959ab301afd030ae6a2a7d2cc729115433a532

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type: image/jpeg
date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: public, max-age=604800
last-modified: Thu, 16 Feb 2023 03:49:50 GMT
accept-ranges: bytes
content-length: 6164
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 bb5953719a-200x112.jpg
earnme.club/wp-content/uploads/2023/02/ 5 KB
6 KB 14ms
13ms Image
image/jpeg 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://earnme.club/wp-content/uploads/2023/02/bb5953719a-200x112.jpg
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 811c20ef9b8b5083c4d16de69e900ba65d98ebce36ac7bd35577ff71e4af1d7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type: image/jpeg
date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: public, max-age=604800
last-modified: Thu, 16 Feb 2023 03:40:32 GMT
accept-ranges: bytes
content-length: 5628
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 honor_magic_4_lite_5g_review__5__thumb-200x112.jpg
earnme.club/wp-content/uploads/2023/02/ 7 KB
7 KB 16ms
15ms Image
image/jpeg 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://earnme.club/wp-content/uploads/2023/02/honor_magic_4_lite_5g_review__5__thumb-200x112.jpg
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 12244df5789b5df67fcd42893b16e99a494eb0469a7228c3dc5afaa6df207da8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type: image/jpeg
date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: public, max-age=604800
last-modified: Thu, 16 Feb 2023 03:30:57 GMT
accept-ranges: bytes
content-length: 6744
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 CMiTcdTJJ986hVG3bC8XnY-compressed-200x112.jpg
earnme.club/wp-content/uploads/2023/02/ 6 KB
6 KB 15ms
14ms Image
image/jpeg 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://earnme.club/wp-content/uploads/2023/02/CMiTcdTJJ986hVG3bC8XnY-compressed-200x112.jpg
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 4e46f9af568f30cf6b0cc6ae79329a0b69f686a57491e9e97ee1dc44a8844c31

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type: image/jpeg
date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: public, max-age=604800
last-modified: Tue, 14 Feb 2023 05:21:37 GMT
accept-ranges: bytes
content-length: 6097
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 oppo-reno-8t-5g-launch-check-specs-features-camera-and-other-details-here-200x112.jpg
earnme.club/wp-content/uploads/2023/02/ 3 KB
3 KB 17ms
16ms Image
image/jpeg 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://earnme.club/wp-content/uploads/2023/02/oppo-reno-8t-5g-launch-check-specs-features-camera-and-other-details-here-200x112.jpg
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 0bdae78710d2f51b913f548d3d0a21818944ab44ba9269873fa118032821df35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type: image/jpeg
date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: public, max-age=604800
last-modified: Thu, 09 Feb 2023 11:19:37 GMT
accept-ranges: bytes
content-length: 3229
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H3 200 maxresdefault-6-200x112.jpg
earnme.club/wp-content/uploads/2023/02/ 5 KB
5 KB 15ms
14ms Image
image/jpeg 157.90.71.190
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://earnme.club/wp-content/uploads/2023/02/maxresdefault-6-200x112.jpg
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 157.90.71.190 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.190.71.90.157.clients.your-server.de
Software: /
Resource Hash: 921f031dcb2b0ebaac6b76687ff61e588c0c6f78b2f264183607e1cd04f28f5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/nord-n1-from-oneplus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type: image/jpeg
date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: public, max-age=604800
last-modified: Thu, 09 Feb 2023 10:50:54 GMT
accept-ranges: bytes
content-length: 5062
expires: Sun, 07 May 2023 15:15:22 GMT

POST
H/1.1 200
OK / Show response
cat2.hbwrapper.com/ 15 B
256 B 349ms
109ms XHR
text/html 68.183.18.251
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://cat2.hbwrapper.com/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 68.183.18.251 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: capture2.analytics.hbwrapper
Software: Apache /
Resource Hash: a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://earnme.club
Date: Sun, 30 Apr 2023 15:15:22 GMT
Access-Control-Allow-Credentials: true
Server: Apache
Connection: close
Content-Length: 15
Content-Type: text/html; charset=UTF-8

GET
H2 200 trace Show response
cloudflare.com/cdn-cgi/ 321 B
456 B 53ms
16ms XHR
text/plain 2606:4700::6810:85e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflare.com/cdn-cgi/trace

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:85e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c6d757cf5862c02b05d2e312fb16244206e95a5b821b875dbbc3389617c63495

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache
cf-ray: 7c00bd60dc6dbb85-FRA
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 227 KB
56 KB 114ms
8ms Script
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e81437bacb2eadf8e9892f7c4423437a86ed8249bf77dcf71770909857779174

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:09:49 GMT
content-encoding: gzip
via: 1.1 5743d3ff81b625f69ad8b8e32fc9c412.cloudfront.net (CloudFront), 1.1 d9523e44e96d2539081596bb1d268d44.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 19:15:18 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P3
age: 334
etag: W/"e301ce991ef543783521cd0156a962ee"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: Dq4pJ4Wkeh1Haow3mfi6ODZMU2IfXTSaIubP81AAKSO_7yYN5vk6ew==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 172 KB
59 KB 101ms
69ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KXJCD57

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

02ba2637239f12ec6c517083a5e3f3120c7888f322e656671d98011646d443bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60506
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 30 Apr 2023 15:15:22 GMT

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
1 KB 33ms
7ms XHR
application/json 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ea41d15456ee37d2a38a1e31034670ced4a19f370a3031353bc5fdaf020bd43d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 30 Apr 2023 15:15:22 GMT
x-content-type-options: nosniff
content-encoding: br
age: 40469
x-jsd-version: 1.0.1688
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 839
x-served-by: cache-fra-eddf8230056-FRA
x-jsd-version-type: version
etag: W/"63c-FJtEv4+V8EkqyBxCPHv95LL4V4A"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET f
fid.agkn.com/ 0
0

GET
H2 200 config.js Show response
cdn.confiant-integrations.net/d2ehZtyVAa1kXxOtMxFp7XciXcU/gpt_and_prebid/ 141 KB
30 KB 50ms
24ms Script
text/javascript 2606:4700:4400::6812:220a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/d2ehZtyVAa1kXxOtMxFp7XciXcU/gpt_and_prebid/config.js
Requested by: Host: adncdnend.azureedge.net
URL: https://adncdnend.azureedge.net/adtags/earnme.adn.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c60b9cdd760085596bca42b06c9b4c42fdf81b629bcbf288eb5e242b93de017e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sun, 30 Apr 2023 10:09:19 GMT
server: cloudflare
x-amz-request-id: R6F5K30FE0N1B2QM
age: 377
etag: W/"a6160f20ec92aba408c1d6d73ad7848c"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=900, stale-while-revalidate=3600
cf-ray: 7c00bd613dec3608-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: Rp1yl8sX55apdNzwqx6zVW5lacWuIHW6k7f24JVJuC8xxCGwVQN58alOsu8vUYiht9mPZ7RsOG8=

GET
H2 200 gcid_s.min.js Show response
p.gcprivacy.com/t/ 9 KB
10 KB 69ms
8ms Script
application/javascript 18.66.122.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://p.gcprivacy.com/t/gcid_s.min.js
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-46.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8548fa5f198e18b0feca552d0f369f4c9fc15b9990ef9d28ab2fc556f3e8153e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id: jt4ZnrYXxK0Tc9o56lUGTSds0r80tPTc
date: Sun, 30 Apr 2023 04:14:34 GMT
via: 1.1 2a6277094357eb47f8dbeacb06ed96c2.cloudfront.net (CloudFront)
last-modified: Mon, 24 Apr 2023 13:48:31 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
age: 39649
x-amz-server-side-encryption: AES256
etag: "dac6676675972d00f4ec994de0578005"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 9500
x-amz-cf-id: 3KfvZZgVEInQzOT65r8ELj-L2hssleyMYD3eFe9kczkNX4gvOMv3yw==

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/openrtb2/ 71 B
968 B 61ms
8ms XHR
application/json 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/openrtb2/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

f00c8a9b21ce0366e1823f775d7568aa84a11b73802dddbd88dd0325abe24b23

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:22 GMT
x-openrtb-version: 2.4
AN-X-Request-Uuid: 48fc6d2b-eb2a-4a0b-b0e7-1d93dc5acadf
Server: nginx/1.21.3
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://earnme.club
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 71
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
167 B 71ms
15ms XHR
text/plain 147.75.84.158
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.84.158 Schiphol, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

x-nbr: 8
date: Sun, 30 Apr 2023 15:15:21 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://earnme.club
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 262 B
1 KB 64ms
17ms XHR
application/json 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

d76d455735329406de99b3a2f727e168d7e924ec56c8bca02b2c3b657aa95800

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:22 GMT
AN-X-Request-Uuid: 7dd6f34c-9205-473a-832a-8c538672e143
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://earnme.club
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 262
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 hbjson Show response
grid.bidswitch.net/ 24 B
237 B 151ms
15ms XHR
application/json 52.59.102.99
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.59.102.99 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-59-102-99.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 44333775bb6d918e91e3f41b850c4b0e51abcae6d11a5a816f8e04dacbe3b5b2

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-encoding: gzip
content-length: 49
content-type: application/json

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
309 B 356ms
34ms XHR
application/json 2a02:2638:d::a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.43.0&cb=73460279022&lsavail=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 30 Apr 2023 15:15:21 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://earnme.club
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 44

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
359 B 55ms
9ms XHR
application/json 51.89.9.252
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.252 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip252.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://earnme.club
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
570 B 149ms
101ms XHR
application/json 104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=775312
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45b05fa503b274bfbe5b626d88f80dd6992b0942c5c4def10d01b4995b2aba79

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=swIQe%2BwEXFLhu4y%2BCWITkZEWz5Iz2fLPDq6mQwojOmFsPOxlbAnMjaOpz5DgpNnJGEPUAQ%2FwsHl5%2BU%2Bw%2FuYpqeO7o5H71Kbcwpe9OfMQ3V9%2FVNrFJmhd4858XpC8%2FT7D2EVi2grW"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://earnme.club
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7c00bd61de8e3689-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37
expires: 0

GET
H2 200 arj Show response
digikulture-d.openx.net/w/1.0/ 73 B
375 B 93ms
28ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://digikulture-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=256e75a8-e4af-4d75-8f70-547a15f41d93%2C12c9bbb2-b9b6-4e91-b883-a60b311e293c&nocache=1682867722487&pubcid=569722ed-1307-4eb3-8bbf-3aa6bd9580da&schain=1.0%2C1!adapex.io%2Cs1602%2C1%2C%2C%2C&aus=300x250%2C336x280%7C300x250%2C336x280&divids=58f86b86-70f8-4229-8d21-d0f386db2e1f%2C22322c8a-d031-474e-bf74-3e5159904d57&aucs=%252F22181265%252Femc_300v_2%2C%252F22181265%252Femc_300v_3&auid=556580798%2C556580799&aumfs=10%2C10
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 0ab0e347c7e63992f8c4a48c48d7b7f7cedae136aac1a9fed66b2d488f23cb5a

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: application/json
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://earnme.club
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
1 KB 151ms
92ms XHR
application/json 34.107.148.139
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: fb2fb6b4f65872e998c55859eeab6acb219e6e1290dd635c94853dcc493b4739

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
via: 1.1 google
server: nginx
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://earnme.club
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
expires: Sun, 30 Apr 2023 15:15:22 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 451 B
776 B 213ms
110ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17262&site_id=409752&zone_id=2294686&size_id=15&alt_size_ids=16&p_pos=atf&rp_schain=1.0,1!adapex.io,s1602,1,,,&eid_pubcid.org=569722ed-1307-4eb3-8bbf-3aa6bd9580da%5E1&rf=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&tg_i.domain=earnme.club&tg_i.page=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&tg_i.pbadslot=%2F22181265%2Femc_300v_2&tg_i.gpid=%2F22181265%2Femc_300v_2&tk_flint=pbjs_lite_v7.43.0&x_source.tid=256e75a8-e4af-4d75-8f70-547a15f41d93&l_pb_bid_id=501030f2ad3591e&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.01&rp_maxbids=1&p_gpid=%2F22181265%2Femc_300v_2&slots=1&rand=0.2453485695600437
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 8c21db1c2fdfdb84f42273ef970a0c6979e0c8c90d161921f262545ebaf9d961

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://earnme.club
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 451
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 451 B
1000 B 211ms
109ms XHR
application/json 2602:803:c003:200::51
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=17262&site_id=409752&zone_id=2294686&size_id=15&alt_size_ids=16&p_pos=atf&rp_schain=1.0,1!adapex.io,s1602,1,,,&eid_pubcid.org=569722ed-1307-4eb3-8bbf-3aa6bd9580da%5E1&rf=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&tg_i.domain=earnme.club&tg_i.page=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&tg_i.pbadslot=%2F22181265%2Femc_300v_3&tg_i.gpid=%2F22181265%2Femc_300v_3&tk_flint=pbjs_lite_v7.43.0&x_source.tid=12c9bbb2-b9b6-4e91-b883-a60b311e293c&l_pb_bid_id=517bf11a846c5c1&p_screen_res=1600x1200&rp_secure=1&rp_hard_floor=0.01&rp_maxbids=1&p_gpid=%2F22181265%2Femc_300v_3&slots=1&rand=0.4284421128393554
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::51 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b011d8462b79069344ee3df21a664097cbe3f2be5ca91bf948f0832f89e0171d

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:22 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://earnme.club
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 451
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 avcplayer.js Show response
player.avplayer.com/script/2/v/ 251 KB
60 KB 82ms
17ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://player.avplayer.com/script/2/v/avcplayer.js
Requested by: Host: tg1.playstream.media
URL: https://tg1.playstream.media/api/adserver/spt?AV_TAGID=62790805abc41c4450002684&AV_PUBLISHERID=62176a72a06fe80ba569d18f
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: /
Resource Hash: 4fb80b7bf623f709e8773d63406d7d20cbb8dda584d2259f86b7cc94050923d1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
last-modified: Thu, 03 Mar 2022 17:18:44 GMT
etag: "1646327924"
x-hw: 1682867722.dop124.am5.t,1682867722.cds112.am5.hn,1682867722.cds314.am5.c
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
accept-ranges: bytes
content-length: 61326

GET
H2 200 track
track1.aniview.com/ 0
98 B 343ms
102ms Image
text/plain 54.159.46.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?pid=62176a72a06fe80ba569d18f&cid=6278fd47e6b0901a49776895&cb=1682867722544&r=earnme.club&stagid=62790805abc41c4450002684&stplid=6278f4f0a7dd573d85421cad&d35=&d65=&d66=7&d74=&e=playerLoaded&str=viewable
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.159.46.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-46-45.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/ 398 KB
123 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37e314bfd8e8cb9262b5ea01059377cea510e23b2215fc93de8b34a5726284a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 07:56:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26346
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126109
x-xss-protection: 0
server: cafe
etag: 6695821980177688499
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 29 Apr 2024 07:56:16 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 2 KB
641 B 144ms
72ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=earnme.club

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3f3353c815917acecb4d30907c8633a2990d3fa7c2faab099b678d63ced56c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 616
x-xss-protection: 0
expires: Sun, 30 Apr 2023 15:15:22 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
3 KB 12ms
12ms XHR
application/json 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fearnme.club&pubid=1ad7261b-91ea-4b6f-b9e9-b83522205b75
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: Server /
Resource Hash: f1177492b054782e2fa6785f309a458507bfbd28a70d7eaac3ee4fa31d585277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 14:34:00 GMT
via: 1.1 d9523e44e96d2539081596bb1d268d44.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
age: 2481
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://earnme.club
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 2326
x-amz-cf-id: YNMENevXoFOj9KDVNzIFn7Qg1dj-xsoLc8FG3WRz-2vOwKl5IaN_KA==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
460 B 107ms
52ms XHR
text/javascript 13.32.105.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&pid=uJN6cemQ60SbD&cb=0&ws=1600x1200&v=23.426.459&t=2000&slots=%5B%7B%22sd%22%3A%2258f86b86-70f8-4229-8d21-d0f386db2e1f%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F22181265%2Femc_300v_2%22%7D%2C%7B%22sd%22%3A%2222322c8a-d031-474e-bf74-3e5159904d57%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F22181265%2Femc_300v_3%22%7D%5D&schain=1.0%2C1!adapex.io%2Cs1602%2C1%2C%2C%2C&pubid=1ad7261b-91ea-4b6f-b9e9-b83522205b75&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.105.197 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-105-197.fra60.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 6fd3ab2be93b19c970fb371964d46d94.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: XJEN8EYJDZX2GXHS9ZBH
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://earnme.club
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: kS3EPl5C9RibU7weSMR74WidoqJsoGd0l8HJwCIrtIceLc3umSCn1Q==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 27ms
11ms XHR
application/javascript 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id: ZtsI5FMPcYjgnUSe6fFwOoK3szNfqbqS
content-encoding: gzip
via: 1.1 920a6dce56a0ee957dbaa3bf4429f8fe.cloudfront.net (CloudFront)
date: Sun, 30 Apr 2023 15:15:22 GMT
x-amz-cf-pop: FRA56-P3
age: 29428
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 27 Apr 2023 23:46:51 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: kOtkn2aflWtAL4g5F4HaVmyuPyq8-5Xf_btTBFqTPi2fuhRI4_6LfQ==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
2 KB 11ms
10ms XHR
application/json 52.222.208.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fearnme.club&pubid=5dff1804-8b85-4514-bcc6-4b8fb563a913
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.208.154 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-208-154.fra56.r.cloudfront.net
Software: Server /
Resource Hash: 8d39d8c07c66cc67e307318a80da7b3c45f7073a2e1d7e01bfb05c9256a5240d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 14:34:00 GMT
via: 1.1 d9523e44e96d2539081596bb1d268d44.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
age: 2481
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://earnme.club
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1577
x-amz-cf-id: xHxoT-swjZG3iIlDw9eOcWjQESzDEH5CFqTrITAkSUasuInJWLsyOw==

GET
H2 200 wrap.js Show response
cdn.confiant-integrations.net/gptprebidnative/202304241206/ 240 KB
74 KB 21ms
20ms Script
application/javascript 2606:4700:4400::6812:220a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.confiant-integrations.net/gptprebidnative/202304241206/wrap.js
Requested by: Host: cdn.confiant-integrations.net
URL: https://cdn.confiant-integrations.net/d2ehZtyVAa1kXxOtMxFp7XciXcU/gpt_and_prebid/config.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::6812:220a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 369f20e17ce9308e9e488e6fdbdf3aa0e3c8c4705b903c23cd610e7c41eedd16

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 24 Apr 2023 16:10:41 GMT
server: cloudflare
x-amz-request-id: XZ11RCVW8E7BAERS
age: 511882
etag: W/"d1226925b093cc62c3879362099dc851"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=31536000
cf-ray: 7c00bd626fa63608-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2: LGX6CogB3mMaHFWKG31RW7YnqNZnQGgCvnLCqxfemdX9/DS2C7N4Ku8MZnPVlHRW/tJqew1vcSo=

GET
H2 200 sync Show response
p2.gcprivacy.com/v2/ 155 B
521 B 322ms
107ms XHR
application/json 44.214.59.34
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p2.gcprivacy.com/v2/sync?pid=Q6CV1VBC&uid=569722ed-1307-4eb3-8bbf-3aa6bd9580da&u=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&h=earnme.club&ref=
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.214.59.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-214-59-34.compute-1.amazonaws.com
Software: /
Resource Hash: a3b7eeb38d81686c533bd413320a78e3f48808a986344345bce610fcece0e6e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://earnme.club
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Max
content-length: 155

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
9 KB 75ms
9ms Script
application/javascript 2620:116:800d:21:e365:4988:e8a7:3270
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KXJCD57
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: f3f47d6a938ede7a828ca47022eee50835e4c9375f7ca41581fa94e25c8e950e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
etag: "DUHyBE1e2vdA+NAhXV6BXg=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Sun, 07 May 2023 15:15:22 GMT

GET
H2 200 adapex.js Show response
c.neodatagroup.com/ 28 KB
9 KB 73ms
7ms Script
text/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://c.neodatagroup.com/adapex.js
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CF6) /
Resource Hash: bc4a331f1ff34c4247d1f873e3e40e3d0a9fa8fb0f0ba9871bcbb10670d92c37

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
content-md5: dOu78EeVebghtGDVxsWkZQ==
age: 3813
x-cache: HIT
content-length: 9310
x-ms-lease-state: available
x-ms-lease-status: unlocked
last-modified: Fri, 28 Apr 2023 14:49:54 GMT
server: ECAcc (frc/4CF6)
etag: "0x8DB47F7D432B597+gzip"
vary: Accept-Encoding
content-type: text/javascript
x-ms-request-id: ef9e3ad5-101e-007e-766d-7b3f20000000
cache-control: max-age=7200
x-ms-version: 2014-02-14
expires: Sun, 30 Apr 2023 17:15:22 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 221 KB
77 KB 53ms
52ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LY1N2M6E7Y&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KXJCD57

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

33af1a2e956e9cd1567753858747397c9ed62540227c7ddd3600a4856977d765

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79152
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sun, 30 Apr 2023 15:15:22 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 114 KB
44 KB 74ms
73ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-249368521-35

Requested by

Host: adncdnend.azureedge.net
URL: https://adncdnend.azureedge.net/adtags/earnme.adn.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e75ee4e9cea69d92bd780079c7f6abdc0529fbfcc67013c41e36e16fd99f28f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45378
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 30 Apr 2023 15:15:22 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
251 B 49ms
18ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-LY1N2M6E7Y&gtm=45je34q0&_p=2092124212&cid=143068231.1682867723&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1682867722&sct=1&seg=0&dl=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&dt=NORD%20N1%20from%20ONEPLUS%20%E2%80%93%20Tech%20News&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LY1N2M6E7Y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:22 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://earnme.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 114 KB
44 KB 47ms
47ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-249368521-35&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-KXJCD57

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

abb1400af20950e0443ed73d5160d2e0deb83e0fc6a99225fe2cd285472995d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45369
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 30 Apr 2023 15:15:22 GMT

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 313ms
99ms Preflight 35.168.115.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.115.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-115-78.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://earnme.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Sun, 30 Apr 2023 15:15:22 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 47ms
7ms Script
application/javascript 23.215.22.18
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.215.22.18 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-215-22-18.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Sun, 30 Apr 2023 15:30:22 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16576/ 38 KB
12 KB 34ms
7ms Script
text/javascript 65.9.66.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-97.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b4a0aeb3f2db12edff7b757d79dc72c1964f48040a73651ca0e6f24c775f1264

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 00:30:12 GMT
content-encoding: gzip
via: 1.1 2fc0d20914c32e5cd76477ed042298d0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 00:13:49 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 53111
x-amz-server-side-encryption: AES256
etag: W/"dc01f342ec44b3f8f5767d7b93fe1ac8"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: f2GXkC0TDQJGkz9vdpDqfWo-SfebTRDF3Dcps-fGkYNDCwscXyvWWQ==

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
10 KB 71ms
43ms Script
application/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&ref=&_it=amazon&partner_id=405
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13f329a0d3e082589a14177df4778b45ea8cb3826ce3b945fcbb0721baca5825

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 18 Nov 2022 10:57:44 GMT
server: cloudflare
x-amz-request-id: TC7EHTWD0RA1E24T
age: 2702
etag: W/"2280e2148e4ee3c06f679f8fac039778"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7c00bd634c932c53-FRA
x-amz-id-2: RgdFNOhTxQWEv6VS9DaEYcR2n80buEsvagxJk3bvLyUuLeh7hxv/OSgDbFCaIX44E628c8uLXJo=

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 63ms
23ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0325b6c9e68ae3f6ec25f6817b4daef364bd99c2ff5f04588fd6f956bf983b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
server: cloudflare
x-amz-request-id: 9Q7EVAR423JQ6AAJ
age: 3162
etag: W/"b58faeda0c1d193bc50dd25a7640d8ba"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c00bd635b1d195e-FRA
x-amz-id-2: HmUf+GCCKXI/yHvrr6D/mRmwlqbg0bGRnl3PvHyUL7FgC6egL1tGjNzZdXmGbHiIFvkx4BMS36g=

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
453 B 100ms
98ms XHR
text/plain 35.168.115.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.115.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-115-78.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Sun, 30 Apr 2023 15:15:23 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ 55 KB
9 KB 81ms
59ms Script
application/javascript 2606:4700:10::6816:35ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&ref=&_it=amazon&partner_id=479
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:35ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13f329a0d3e082589a14177df4778b45ea8cb3826ce3b945fcbb0721baca5825

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Fri, 18 Nov 2022 10:57:44 GMT
server: cloudflare
x-amz-request-id: TC7EHTWD0RA1E24T
age: 2702
etag: W/"2280e2148e4ee3c06f679f8fac039778"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 7c00bd634c962c53-FRA
x-amz-id-2: RgdFNOhTxQWEv6VS9DaEYcR2n80buEsvagxJk3bvLyUuLeh7hxv/OSgDbFCaIX44E628c8uLXJo=

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
462 B 100ms
99ms XHR
text/plain 35.168.115.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.115.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-115-78.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Sun, 30 Apr 2023 15:15:23 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 310ms
99ms Preflight 35.168.115.78
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.168.115.78 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-168-115-78.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://earnme.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Sun, 30 Apr 2023 15:15:22 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 146ms
47ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=earnme.club

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 153ms
46ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=earnme.club

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 443 KB
124 KB 725ms
725ms XHR
text/plain 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1792785991261384&correlator=2557248057209045&eid=31072878&output=ldjh&gdfp_req=1&vrg=202304250101&ptt=17&impl=fifs&iu_parts=21735448363%3A22367406785%2Cearnme.club&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C970x90%2C320x50%7C336x280%7C300x250%7C250x250%7C200x200%2C320x50%7C336x280%7C300x250%7C250x250%7C200x200%2C320x50%7C336x280%7C300x250%7C250x250%7C200x200%2C320x50%7C336x280%7C300x250%7C250x250%7C200x200%2C1x1%2C1x1&fluid=height%2Cheight%2Cheight%2Cheight%2Cheight%2C0%2C0&ifi=1&adks=2564538650%2C174271564%2C174271567%2C174271566%2C174271561%2C3490001028%2C3490001051&didk=1813635145~1813635144~1813637047~1813637046~1813637045~471193909~471193910&sfv=1-0-40&ists=3&fas=0%2C0%2C0%2C0%2C0%2C1%2C8&eri=4&sc=1&cookie_enabled=1&cdm=earnme.club&abxe=1&dt=1682867722809&dlt=1682867722155&idt=600&adxs=323%2C-9%2C475%2C977%2C-9%2C-9%2C-9&adys=158%2C-9%2C1167%2C1891%2C-9%2C-9%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C-1%7C0%7C1%7C-1%7C-1%7C-1&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fearnme.club%2F&loc=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&frm=20&vis=1&psz=968x0%7C0x-1%7C640x0%7C299x0%7C0x-1%7C0x-1%7C0x-1&msz=954x0%7C0x-1%7C640x0%7C299x0%7C0x-1%7C0x-1%7C0x-1&fws=0%2C2%2C0%2C512%2C2%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0&ga_vid=143068231.1682867723&ga_sid=1682867723&ga_hid=2092124212&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0efcb7ca122ec6c162d9570d27679edcb592a1bc641debfc4cf582f07ad8d45b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126480
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://earnme.club
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame CBFE 6 KB
3 KB 178ms
43ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/ 33 KB
12 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3d94d22087df59281d402ce90aac94a521602f6429ce32bf987a3dd5d46692ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 14:19:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3352
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11983
x-xss-protection: 0
server: cafe
etag: 3857569901812544741
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Mon, 29 Apr 2024 14:19:30 GMT

GET
H2 200 hls.min.js Show response
player.avplayer.com/script/2/2.55/libs/ 247 KB
70 KB 19ms
18ms Script
application/javascript 69.16.175.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://player.avplayer.com/script/2/2.55/libs/hls.min.js
Requested by: Host: player.avplayer.com
URL: https://player.avplayer.com/script/2/v/avcplayer.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: tlb.hwcdn.net
Software: /
Resource Hash: 87bdf34d158b451ca6e6113760d8f959d43ad17373c7ac0aa70b6789f21a26b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
content-encoding: gzip
last-modified: Sun, 10 Jan 2021 14:52:52 GMT
etag: "1610290372"
x-hw: 1682867722.dop124.am5.t,1682867722.cds112.am5.hn,1682867722.cds314.am5.c
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=600
accept-ranges: bytes
content-length: 71831

GET
DATA 200
OK truncated
/ 216 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 41c8460c9c718fb0e8c275b7baa9083f5477ec0919bab552ef952ecee74c567b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 256 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7bb3c50cc5b07cea81e62a53039ec4aa49cd718058cbf799eef27bbdb5b958c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 251 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a288f6d8bed5da66244881b97b6355d945f6ca755c1fc09b750724745cceae03

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 385 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 82df16c2b9566862302bf45688a07667a9e658325d3fb54e5dcf9482306a39fa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 273 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f1c0e9e76f5baa28c2453d0d02b97d42e5f66283f0d3058a4ccc366e7f2411a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 411 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fbfd3438e10ab28f28f2e1a1fb2ab3bfa431336af08a72f597c0d4d73bfb046e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 237 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e4446065ebfb65a302d17b88e2c7ed326d8402769eab0843833dea049a65c992

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 238 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b26c04ff19851d0780ba6dbc37d4920b48f3eeb54963c9ea1667941e01bb7ed

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 240 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eaa3d12c6890efadb732d28d679f37a9d9f513ac686e7de453e82000612a7536

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 logo.png
cdn.playstream.media/ 1 KB
2 KB 57ms
9ms Image
image/png 2400:52e0:1e00::863:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.playstream.media/logo.png
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::863:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-863 /
Resource Hash: 875a318ebf906866ab16eb2e848924b12c38f7d33ae1c6e72244aba92faa9b7b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

cdn-requestpullsuccess: True
date: Sun, 30 Apr 2023 15:15:22 GMT
cdn-edgestorageid: 864
cdn-cachedat: 02/05/2023 21:16:32
cdn-pullzone: 1027527
content-length: 1265
last-modified: Tue, 19 Jan 2021 07:48:16 GMT
server: BunnyCDN-DE1-863
cdn-proxyver: 1.03
cdn-requestpullcode: 206
content-type: image/png
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 6740a699-531f-4e34-81bd-7039b1357022
cache-control: max-age=315360000
cdn-requestid: f2f60508d1e385ae2dc8c5474330297b
accept-ranges: bytes
cdn-requestcountrycode: DE
cdn-status: 200
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 480 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee9a49aae5d1fc7602361ae5c6d69fc8eb128d007b4dee67d42ce19bbf2c87e0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 ctrack
track1.avplayer.com/ 0
98 B 328ms
102ms Image
text/plain 34.195.250.234
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&cmid=&cwid=&cvid=&pid=62176a72a06fe80ba569d18f&r=earnme.club&sn=&cd1=&cd2=&cd3=&app=&wi=640&he=361&test=&vi=100&e=cpll&cb=1682867722857
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.250.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-250-234.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 51 KB
12 KB 558ms
558ms XHR
text/plain 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1792785991261384&correlator=2557248057209045&eid=31072878&output=ldjh&gdfp_req=1&vrg=202304250101&ptt=17&impl=fifs&iu_parts=339474670%3A22582052307%2CEarnMe%2CSticky_Footer&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x90&ifi=8&adks=3386701421&didk=3796008259&sfv=1-0-40&eri=4&cust_params=wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dnf%26gpt_l%3D400%26wrap_l%3D1000%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D0%26padpr%3D5%26idl_envtest%3Dna%26lipbtest%3Dna%26lotamePanoramaIdtest%3Dna%26id5idtest%3Dna%2633acrossIdtest%3Dna%26teadsIdtest%3Dna%26fabrickIdtest%3Dna%26uids%3Dpubcid%26uids_c%3D1%26waai%3D100%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&cdm=earnme.club&abxe=1&dt=1682867722920&dlt=1682867722155&idt=600&adxs=315&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fearnme.club%2F&loc=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&frm=20&vis=1&psz=970x-1&msz=970x-1&fws=512&ohw=0&ga_vid=143068231.1682867723&ga_sid=1682867723&ga_hid=2092124212&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65b18c620a577434cafb394446a41fe9308c6fe7fad6f3154d143405f54df5bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12391
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://earnme.club
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 169 KB
20 KB 950ms
950ms XHR
text/plain 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1792785991261384&correlator=2557248057209045&eid=31072878&output=ldjh&gdfp_req=1&vrg=202304250101&ptt=17&impl=fifs&iu_parts=339474670%3A22582052307%2CEarnMe%2CSide&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x600%7C300x250&ifi=9&adks=2753549987&didk=1363982333&sfv=1-0-40&eri=4&cust_params=wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dnf%26gpt_l%3D400%26wrap_l%3D1000%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D0%26padpr%3D5%26idl_envtest%3Dna%26lipbtest%3Dna%26lotamePanoramaIdtest%3Dna%26id5idtest%3Dna%2633acrossIdtest%3Dna%26teadsIdtest%3Dna%26fabrickIdtest%3Dna%26uids%3Dpubcid%26uids_c%3D1%26waai%3D100%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&cdm=earnme.club&abxe=1&dt=1682867722926&dlt=1682867722155&idt=600&adxs=977&adys=264&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fearnme.club%2F&loc=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&frm=20&vis=1&psz=299x0&msz=299x0&fws=512&ohw=0&ga_vid=143068231.1682867723&ga_sid=1682867723&ga_hid=2092124212&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

42c211109f52303a3825dba1f6ecf3257815017a59dbf07ffc1956aeb236297f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20470
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://earnme.club
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 16 KB
7 KB 1244ms
1243ms XHR
text/plain 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1792785991261384&correlator=2557248057209045&eid=31072878&output=ldjh&gdfp_req=1&vrg=202304250101&ptt=17&impl=fifs&iu_parts=339474670%3A22582052307%2CEarnMe%2CInContent&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C336x280%7C468x60&ifi=10&adks=1941635345&didk=2094891793&sfv=1-0-40&eri=4&cust_params=wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dnf%26gpt_l%3D400%26wrap_l%3D1000%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D0%26padpr%3D5%26idl_envtest%3Dna%26lipbtest%3Dna%26lotamePanoramaIdtest%3Dna%26id5idtest%3Dna%2633acrossIdtest%3Dna%26teadsIdtest%3Dna%26fabrickIdtest%3Dna%26uids%3Dpubcid%26uids_c%3D1%26waai%3D100%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&cdm=earnme.club&abxe=1&dt=1682867722929&dlt=1682867722155&idt=600&adxs=493&adys=1075&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=a&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fearnme.club%2F&loc=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&frm=20&vis=1&psz=640x0&msz=640x0&fws=0&ohw=0&ga_vid=143068231.1682867723&ga_sid=1682867723&ga_hid=2092124212&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1ce41b73897e14081f9d26ecca9b7aef9b3df4371e588a104da38bd96c356aa2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7000
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://earnme.club
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 24 KB
10 KB 1608ms
1608ms XHR
text/plain 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1792785991261384&correlator=2557248057209045&eid=31072878&output=ldjh&gdfp_req=1&vrg=202304250101&ptt=17&impl=fifs&iu_parts=339474670%3A22582052307%2CEarnMe%2CATF&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x90%7C970x250&ifi=11&adks=1276275020&didk=3761380518&sfv=1-0-40&eri=4&cust_params=wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dnf%26gpt_l%3D400%26wrap_l%3D1000%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D0%26padpr%3D5%26idl_envtest%3Dna%26lipbtest%3Dna%26lotamePanoramaIdtest%3Dna%26id5idtest%3Dna%2633acrossIdtest%3Dna%26teadsIdtest%3Dna%26fabrickIdtest%3Dna%26uids%3Dpubcid%26uids_c%3D1%26waai%3D100%26amznbid%3D0%26amznp%3D0&sc=1&cookie_enabled=1&cdm=earnme.club&abxe=1&dt=1682867722933&dlt=1682867722155&idt=600&adxs=323&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=b&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fearnme.club%2F&loc=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&frm=20&vis=1&psz=968x0&msz=954x0&fws=0&ohw=0&ga_vid=143068231.1682867723&ga_sid=1682867723&ga_hid=2092124212&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

147fa9f0978c6eadd0d2ed1783952600685812b83a3e143d903db422e9e69b02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10013
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://earnme.club
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 283ms
16ms Preflight
application/json 2a02:2638:d::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fearnme.club%2F&domain=earnme.club&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://earnme.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://earnme.club
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 286886
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
247 B 250ms
101ms XHR
application/json 2600:1901:0:8344::
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&gdpr=0&src=pbjs&ver=7.43.0
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1901:0:8344:: Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 30 Apr 2023 15:15:22 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://earnme.club
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
385 B 49ms
16ms XHR
application/json 2a02:2638:d::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fearnme.club%2F&domain=earnme.club&cw=1&lsw=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://earnme.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 298778
expires: 0

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 141 B
305 B 75ms
25ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=405&_it=prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cce336f4fcdd345b5311dbacb6040eafcd60805f98054fef1715c7a90ea06b0

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: gzip
server: cloudflare
allow: POST, OPTIONS, GET
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cf-ray: 7c00bd64bf51046e-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H/1.1 200 prebid Show response
id5-sync.com/api/config/ 135 B
540 B 96ms
33ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

480613f771d4b2960ecbcbf9f0a8435d009d8f5fd10ab14bba1b1018762708e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 200 any Show response
idx.liadm.com/idex/prebid/ 50 B
426 B 417ms
117ms XHR
application/json 52.205.24.151
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/prebid/any?resolve=nonId

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.205.24.151 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-205-24-151.compute-1.amazonaws.com

Software

Resource Hash

abfaddaf1f0c21fd09a16fcac7fdcd7927e2d12586e9e86d6fcc85095f977715

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
request-time: 15
content-type: application/json
access-control-allow-origin: https://earnme.club
access-control-allow-credentials: true
trace-id: 0a7d7cf2918d1748
content-length: 50
expires: Mon, 01 May 2023 15:15:23 GMT

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
315 B 106ms
30ms XHR
application/json 34.252.16.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.16.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-16-161.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:23 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://earnme.club
cache-control: no-cache
x-server: 10.45.23.147
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H/1.1 200
OK fpc Show response
at.teads.tv/ 0
334 B 69ms
39ms XHR
text/plain 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://at.teads.tv/fpc?analytics_tag_id=PUB_17018&tfpvi=&gdpr_consent=&gdpr_status=22&gdpr_reason=220&ccpa_consent=&sv=prebid-v1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:23 GMT
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: https://earnme.club
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Sun, 30 Apr 2023 15:15:23 GMT

GET
H2 200 AVmanager.js Show response
player.aniview.com/script/6.1/ Frame 4224 462 KB
124 KB 68ms
7ms Script
application/javascript 2a02:26f0:480:7b5::2c79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=62176a72a06fe80ba569d18f
Requested by: Host: player.avplayer.com
URL: https://player.avplayer.com/script/2/v/avcplayer.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2a02:26f0:480:7b5::2c79 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 27af549b88fd1d89121da082eb63e01df88ca6881aa7e92725773568649e6e1e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: gzip
x-guploader-uploadid: ADPycdtAGSUmmIOrhjbTjY8nclWc1sZ7qZ8qdx2ENdk0IwdZBzmSSiSk8Et5JsZ1Oshbvoig1peWXiXgbvHbE_xacZip4Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
content-length: 126168
last-modified: Thu, 27 Apr 2023 08:30:09 GMT
server: UploadServer
etag: "f4715209e94289716ee60a5c6af13de2"
vary: Accept-Encoding
x-goog-generation: 1682584209182368
content-type: application/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=Z41h1w==, md5=9HFSCelCiXFu5gpcavE94g==
access-control-expose-headers: Content-Type
cache-control: public, max-age=600
x-goog-stored-content-length: 126168
accept-ranges: bytes
expires: Sun, 30 Apr 2023 15:25:23 GMT

GET
H2 200 rules-p-WFJsXCa9VD158.js Show response
rules.quantcount.com/ 160 B
634 B 42ms
7ms Script
application/javascript 2600:9000:223c:fa00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-WFJsXCa9VD158.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:fa00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c505f7e821ae7a1c88e6ce02d8e38b57233d9997445ce06b9ce50be989df5d7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 14:27:33 GMT
via: 1.1 93b8205e2f07a7099af2e6fd126d9658.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 2871
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Tue, 11 Apr 2023 19:39:28 GMT
server: AmazonS3
etag: "8451e96214684fb5c6ec4f91dde0548e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: Zwh2ruCh2p9HIi6cGmAW_kSb3GcGLnawLQ9xpOD7Y9FL-lSRSFbQ6w==

GET
H2 200 ps-topics.html Show response
c.neodatagroup.com/ Frame 0E17 2 KB
1 KB 7ms
7ms Document
text/html 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://c.neodatagroup.com/ps-topics.html?sid=2033
Requested by: Host: c.neodatagroup.com
URL: https://c.neodatagroup.com/adapex.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CB9) /
Resource Hash: 3857634543824c46b5f1f435e9375e75e0ad96b16d9bf4525e54f0f14bfb25e8

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3821
cache-control: max-age=7200
content-encoding: gzip
content-length: 918
content-md5: 8KzndH43fcLeRwVWvG3dqA==
content-type: text/html
date: Sun, 30 Apr 2023 15:15:22 GMT
etag: "0x8DB47F72DB48BAD+gzip"
expires: Sun, 30 Apr 2023 17:15:22 GMT
last-modified: Fri, 28 Apr 2023 14:45:15 GMT
server: ECAcc (frc/4CB9)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-state: available
x-ms-lease-status: unlocked
x-ms-request-id: 4b01b773-201e-00f3-5e6d-7b08f2000000
x-ms-version: 2014-02-14

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 96 B
282 B 131ms
131ms XHR
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=405&sync=0&domain=earnme.club&url=https://earnme.club/nord-n1-from-oneplus/
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&ref=&_it=amazon&partner_id=405
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5fc6fbef2fb8eaf187a27ed6ddcf9e41d40d74fb8f2ba6a70050f4ff4bec74cf

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 7c00bd65988d046e-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 116ms
116ms Preflight
application/json 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=405&sync=0&domain=earnme.club&url=https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://earnme.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 7c00bd64ef9d046e-FRA
content-length: 0
content-type: application/json
date: Sun, 30 Apr 2023 15:15:23 GMT
debug: OPTIONS block
expires: Mon, 29 Apr 2024 15:15:23 GMT
server: cloudflare

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 185 KB
26 KB 561ms
561ms XHR
text/plain 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1792785991261384&correlator=2557248057209045&eid=31072878&output=ldjh&gdfp_req=1&vrg=202304250101&ptt=17&impl=fifs&iu_parts=22181265%3A22367406785%2Cemc_300v_2%2Cemc_300v_3&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=300x250%7C336x280%2C300x250%7C336x280&ifi=12&adks=3465553579%2C2149572299&didk=488294001~2824464116&sfv=1-0-40&prev_scp=refresh_count%3D0%26amznbid%3D2%26amznp%3D2%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26amznbid%3D2%26amznp%3D2%26hb_bd%3D0%26anh%3Dtrue&eri=4&cust_params=wvr%3D3%26wie%3Dtop%26cndl%3D1%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dnf%26gpt_l%3D400%26wrap_l%3D1000%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D0%26padpr%3D5%26idl_envtest%3Dna%26lipbtest%3Dna%26lotamePanoramaIdtest%3Dna%26id5idtest%3Dna%2633acrossIdtest%3Dna%26teadsIdtest%3Dna%26fabrickIdtest%3Dna%26uids%3Dpubcid%26uids_c%3D1%26waai%3D100%26amznbid%3D0%26amznp%3D0%26waae%3D500%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D0s&sc=1&cookie_enabled=1&cdm=earnme.club&abxe=1&dt=1682867723032&dlt=1682867722155&idt=600&adxs=493%2C977&adys=879%2C696&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=c%7Cd&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fearnme.club%2F&loc=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&frm=20&vis=1&psz=640x0%7C299x0&msz=640x0%7C299x0&fws=0%2C512&ohw=0%2C0&ga_vid=143068231.1682867723&ga_sid=1682867723&ga_hid=2092124212&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e84df8f588d48b77639986554b3fd632ced1d1464d5b1b5535b4d1523483716b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27013
x-xss-protection: 0
google-lineitem-id: -1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://earnme.club
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
330 B 39ms
30ms XHR
application/json 34.252.16.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.16.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-16-161.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 7fa335c8ef3be2271bfc30a3533d218ff26e04cfbe0bb807cc6a360691dfcf30

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:23 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://earnme.club
cache-control: no-cache
x-server: 10.45.9.168
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
398 B 37ms
12ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203177.ip-141-95-33.eu

Software

Resource Hash

a63f6ee7811c95c619d7c10da51d3cfcfd5cf3ae067428df7f49f63ea3e3c99e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
398 B 31ms
12ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203177.ip-141-95-33.eu

Software

Resource Hash

a63f6ee7811c95c619d7c10da51d3cfcfd5cf3ae067428df7f49f63ea3e3c99e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 124ms
38ms Script
text/javascript 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-249368521-35

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 30 Apr 2023 14:35:44 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 2379
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Sun, 30 Apr 2023 16:35:44 GMT

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
398 B 23ms
9ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203177.ip-141-95-33.eu

Software

Resource Hash

a63f6ee7811c95c619d7c10da51d3cfcfd5cf3ae067428df7f49f63ea3e3c99e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

POST
H/1.1 200 1262.json Show response
id5-sync.com/g/v2/ 216 B
621 B 28ms
14ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1262.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

2805e6140273834a39336a88ccd89129917775020fbb4bb2f503c574f5d7e282

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

POST
H/1.1 200 579.json Show response
id5-sync.com/g/v2/ 216 B
621 B 43ms
13ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

1143cb5bb10e4ac7b88ac53502a88a794c44a1c5e6c7312eb803840c8d16fabf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 pixel;r=286355904;source=gtm;rf=0;a=p-WFJsXCa9VD158;url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F;uht=2;fpan=1;fpa=P0-116003151-1682867722977;pbc=;ns=0;ce=1;qjs=1;qv=93f4cf8b-202303291532...
pixel.quantserve.com/ 35 B
372 B 17ms
10ms Image
image/gif 2620:116:800d:21:e365:4988:e8a7:3270
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=286355904;source=gtm;rf=0;a=p-WFJsXCa9VD158;url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F;uht=2;fpan=1;fpa=P0-116003151-1682867722977;pbc=;ns=0;ce=1;qjs=1;qv=93f4cf8b-20230329153214;cm=;gdpr=0;ref=;d=earnme.club;dst=0;et=1682867723113;tzo=0;ogl=;ses=04456136-1f21-423d-a574-3fd53cb24b51

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:23 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 / Show response
go1.aniview.com/api/adserver/tag/ 27 KB
4 KB 479ms
228ms XHR
application/json 34.196.26.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://go1.aniview.com/api/adserver/tag/?AV_TAGID=62790805abc41c4450002684&AV_PUBLISHERID=62176a72a06fe80ba569d18f&AV_VIDEOURL=https%3A%2F%2Fstreaming.playstream.media%2Fstorage%2Fvideos%2Fc463fba7-7397-40d0-a354-8a8830e1e23c%2Findex.m3u8&AV_SLOTT=-2&AV_SECURED=1&AV_LANGUAGE=en&AV_URL=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&AV_CHANNELID=6278fd47e6b0901a49776895&tgt=0&AV_SUBID=&AV_CDIM1=&AV_CDIM2=&AV_CDIM3=&AV_ABT=&pce=1&npx=1&AV_DETDOMAIN=earnme.club&AV_DADPOS=1&AV_PLACEMENT=1&AV_TAG=62790805abc41c4450002684&AV_TEMPLATE=6278f4f0a7dd573d85421cad&d36=6.2.93&responsive=1&sver=4&avtoken=723149&omv=1.0.1&clsid=797fba0c-37a2-401d-8417-0927a3f3bf6c&rando=33&AV_WIDTH=640&AV_HEIGHT=361&AV_DNT=0&cb=1682867723153&wfc=1
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=62176a72a06fe80ba569d18f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.196.26.133 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-196-26-133.compute-1.amazonaws.com
Software: /
Resource Hash: 31d0107c89add7d653e70e8c25c9147613d4cdb2e242af8972b1b831b4a2fce7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
x-bamboo-c-skst: 1
content-encoding: gzip
x-bamboo-c-skfe: 1
x-bamboo-c-s: BYPASS
access-control-max-age: 1728000
vary: Accept-Encoding
access-control-allow-methods: GET, POST, DELETE, PUT, OPTIONS, INDEX
access-control-allow-origin: https://earnme.club
content-type: application/json
cache-control: no-cache
access-control-allow-credentials: true
access-control-allow-headers: Keep-Alive,User-Agent,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Bamboo-Token,Event-Id,X-Requested-With
expires: Wed, 19 Apr 2023 01:28:43 GMT

GET
H2 200 track
track1.aniview.com/ 0
97 B 103ms
102ms Image
text/plain 54.159.46.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?r=earnme.club&sn=&ic=0&tgt=0&app=&wi=640&he=361&test=&d36=6.2.93&apppkg=&fv=1&proto=https&clsid=797fba0c-37a2-401d-8417-0927a3f3bf6c&rando=33&pid=62176a72a06fe80ba569d18f&cid=6278fd47e6b0901a49776895&stagid=62790805abc41c4450002684&stplid=6278f4f0a7dd573d85421cad&e=inventory&vi=100&cb=1682867723152
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.159.46.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-46-45.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

POST
H/1.1 200 579.json Show response
id5-sync.com/g/v2/ 216 B
621 B 10ms
10ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

c6a1483dae24b1f97db14d882e182b0c281cbaf3c3bfc6b9f1b6c0920692030b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:22 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

GET
H2 200 index.m3u8 Show response
streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/ 111 B
716 B 43ms
7ms XHR
application/vnd.apple.mpegurl 2400:52e0:1e00::863:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/index.m3u8
Requested by: Host: player.avplayer.com
URL: https://player.avplayer.com/script/2/2.55/libs/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::863:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-863 /
Resource Hash: b7a0c757f7f6389ac7abdaa629e26a6098544ae42b571a36b74e8106c9b36e0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

cdn-requestpullsuccess: True
date: Sun, 30 Apr 2023 15:15:23 GMT
cdn-edgestorageid: 863
cdn-cachedat: 04/16/2023 08:14:07
cdn-pullzone: 1024237
content-length: 111
last-modified: Sun, 16 Apr 2023 07:45:47 GMT
server: BunnyCDN-DE1-863
cdn-proxyver: 1.03
cdn-requestpullcode: 200
etag: "643ba7ab-6f"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 6740a699-531f-4e34-81bd-7039b1357022
cache-control: max-age=315360000
cdn-requestid: b3f599a4848d8f503dbb6319a7006015
accept-ranges: bytes
cdn-requestcountrycode: DE
access-control-allow-headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, X-CSRF-TOKEN
cdn-status: 200
expires: Thu, 31 Dec 2037 23:55:55 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
203 B 45ms
45ms XHR
text/plain 2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=2092124212&t=pageview&_s=1&dl=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&ul=en-us&de=UTF-8&dt=NORD%20N1%20from%20ONEPLUS%20%E2%80%93%20Tech%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1234497615&gjid=1803989946&cid=143068231.1682867723&tid=UA-249368521-35&_gid=2104173016.1682867723&_r=1&gtm=457e34q0&jsscut=1&z=785677026

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://earnme.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index_0_250.m3u8 Show response
streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/ 628 B
833 B 8ms
7ms XHR
application/vnd.apple.mpegurl 2400:52e0:1e00::863:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/index_0_250.m3u8
Requested by: Host: player.avplayer.com
URL: https://player.avplayer.com/script/2/2.55/libs/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::863:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-863 /
Resource Hash: 07728752a368d41c2fe1a3c5178ee2a581b1caed13f3b58b6271b0b3aa35e808

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

cdn-requestpullsuccess: True
date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: br
cdn-edgestorageid: 1049
cdn-cachedat: 04/16/2023 08:14:07
cdn-pullzone: 1024237
last-modified: Sun, 16 Apr 2023 07:45:46 GMT
server: BunnyCDN-DE1-863
cdn-proxyver: 1.03
cdn-requestpullcode: 200
etag: W/"643ba7aa-274"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: application/vnd.apple.mpegurl
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 6740a699-531f-4e34-81bd-7039b1357022
cache-control: max-age=315360000
cdn-requestid: 57d3f126c7574288f677d9a5ce80108b
cdn-requestcountrycode: DE
access-control-allow-headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, X-CSRF-TOKEN
cdn-status: 200
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 index_0_250_00000.ts Show response
streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/ 600 KB
601 KB 8ms
7ms XHR
video/mp2t 2400:52e0:1e00::863:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/index_0_250_00000.ts
Requested by: Host: player.avplayer.com
URL: https://player.avplayer.com/script/2/2.55/libs/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::863:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-863 /
Resource Hash: ee637c7a5f0b07ef41816916b548afe7c31c301c6ebc1c8af908bedf2ded5f1d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

cdn-requestpullsuccess: True
date: Sun, 30 Apr 2023 15:15:23 GMT
cdn-edgestorageid: 1078
cdn-cachedat: 04/16/2023 08:14:09
cdn-pullzone: 1024237
content-length: 614196
last-modified: Sun, 16 Apr 2023 07:45:21 GMT
server: BunnyCDN-DE1-863
cdn-proxyver: 1.03
cdn-requestpullcode: 200
etag: "643ba791-95f34"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 6740a699-531f-4e34-81bd-7039b1357022
cache-control: max-age=315360000
cdn-requestid: 263f48cc61df4c698e1fe904ba1fdae7
accept-ranges: bytes
cdn-requestcountrycode: DE
access-control-allow-headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, X-CSRF-TOKEN
cdn-status: 200
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
BLOB 200
OK 14873921-0133-4a69-9c3b-b580d2792022
https://earnme.club/ 63 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://earnme.club/14873921-0133-4a69-9c3b-b580d2792022
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Length: 64352
Content-Type: text/javascript

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 179ms
85ms XHR
application/json 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202304250101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9aa631e988972b5d7514c67e380b577ab5f921e5e0724801673d3b7ff2d9f07b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11205
x-xss-protection: 0

GET
H2 200 405 Show response
a.ad.gt/api/v1/u/matches/ 11 KB
4 KB 62ms
19ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/405?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&ref=&_it=amazon&partner_id=405
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1eaaeb5577cd0914f1749f095a243accd46acedc598840f48994672c8a0825ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 30 Apr 2023 15:14:46 GMT
server: cloudflare
age: 37
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 7c00bd66b9ce18e3-FRA

GET
H2 200 index_0_250_00001.ts Show response
streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/ 433 KB
435 KB 9ms
8ms XHR
video/mp2t 2400:52e0:1e00::863:1
BUNNYCDN

General

Check archive.org

Show headers Download Go to

Full URL: https://streaming.playstream.media/storage/videos/c463fba7-7397-40d0-a354-8a8830e1e23c/index_0_250_00001.ts
Requested by: Host: player.avplayer.com
URL: https://player.avplayer.com/script/2/2.55/libs/hls.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2400:52e0:1e00::863:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software: BunnyCDN-DE1-863 /
Resource Hash: dcb21012ab9d86633f36b33687e2ea39d9cef2c12ef04cc0ca5d9fd56ce0bc5f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

cdn-requestpullsuccess: True
date: Sun, 30 Apr 2023 15:15:23 GMT
cdn-edgestorageid: 1077
cdn-cachedat: 04/16/2023 08:14:09
cdn-pullzone: 1024237
content-length: 443868
last-modified: Sun, 16 Apr 2023 07:45:24 GMT
server: BunnyCDN-DE1-863
cdn-proxyver: 1.03
cdn-requestpullcode: 200
etag: "643ba794-6c5dc"
access-control-allow-methods: GET, POST, OPTIONS, HEAD
content-type: video/mp2t
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: 6740a699-531f-4e34-81bd-7039b1357022
cache-control: max-age=315360000
cdn-requestid: 8c3b4845fcf1c2b6aab7213d2fbd47c1
accept-ranges: bytes
cdn-requestcountrycode: DE
access-control-allow-headers: Authorization, Origin, X-Requested-With, Content-Type, Accept, X-CSRF-TOKEN
cdn-status: 200
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 552 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 058bc5e95f1b17f0af263e284d3801d683cb0ab79cee4bd2d5265ba0e2d6b336

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 ctrack
track1.avplayer.com/ 0
97 B 102ms
101ms Image
text/plain 34.195.250.234
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.avplayer.com/ctrack?pt=2&cmid=&cwid=&cvid=&pid=62176a72a06fe80ba569d18f&r=earnme.club&sn=&cd1=&cd2=&cd3=&app=&wi=640&he=361&test=&vi=100&e=cply&cb=1682867723310
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.250.234 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-250-234.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 216ms
109ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 30 Apr 2023 15:15:23 GMT

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 2 KB
2 KB 63ms
15ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3b89401fea631023de67ae75bf8f246b1af109a9a4247c3862016949eacc462b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 14:21:50 GMT
via: 1.1 google
age: 3213
x-guploader-uploadid: ADPycdsFBU0qHFk__VnThdLaDV4xRGL2aCGb44hMnkM4LZECcBRxIIR24RQQGXT8Dcr9Vn-IMY9XhO0EotWMVHqeA_BagA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1938
last-modified: Thu, 27 Apr 2023 19:53:17 GMT
server: UploadServer
etag: "0a4a90264145ed4c5c647dae5dfb0429"
x-goog-generation: 1682625197861193
x-goog-hash: crc32c=jhvysQ==, md5=CkqQJkFF7UxcZH2uXfsEKQ==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 1938
accept-ranges: bytes
expires: Sun, 30 Apr 2023 15:21:50 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 38 KB
12 KB 8ms
7ms Script
text/javascript 65.9.66.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-97.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9cf4fc9350f69e442ebfdf130d4e601377e9273b642282a1ebb4f79d6116e8c5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 00:30:12 GMT
content-encoding: gzip
via: 1.1 2fc0d20914c32e5cd76477ed042298d0.cloudfront.net (CloudFront)
last-modified: Thu, 27 Apr 2023 00:14:05 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 53112
x-amz-server-side-encryption: AES256
etag: W/"37e703da55f96b973658b8e7aeed0e93"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: qlYDWJkaJK9k3m7IgDNKoXN5dDkekfaa_rMXlm2p3W85KmKZ9e2EUw==

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 18ms
7ms Script
application/javascript 2a04:4e42::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_256_GCM

Server

2a04:4e42::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 30 Apr 2023 15:15:23 GMT
x-content-type-options: nosniff
age: 8115
x-jsd-version: master
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 732
x-served-by: cache-fra-eddf8230079-FRA
x-jsd-version-type: branch
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 69ms
8ms Script
text/javascript 2600:9000:2250:3400:a:e047:752:b361
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:3400:a:e047:752:b361 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 71fc1599035adc6bc34df2117b8631285905f97737ba730af28644ee6a0d8dde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 02:50:38 GMT
Via: 1.1 1b3f5dc0b3c577dc5e7394bf12aed238.cloudfront.net (CloudFront)
Last-Modified: Mon, 23 Jan 2023 04:07:36 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P2
Age: 44686
x-amz-server-side-encryption: AES256
ETag: "aded621b17723f487b3c9d0e43cf2f94"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1859
X-Amz-Cf-Id: drxb3gGUxhhJqIH7wwtrcS5G4Z8vlxLwEnKDaLas9PvQxvCN6KhFwg==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 59 KB
17 KB 24ms
24ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d961a31d3d2fdb93a35a4024f9878b2ed896cd86a084ceb8df6af3bc53e29125

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 06 Apr 2023 12:00:04 GMT
server: cloudflare
x-amz-request-id: RJG8P9KGT25NARJA
age: 1265
etag: W/"110f0c3c343ee36404c8a2300f4755c3"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7c00bd67d92f195e-FRA
x-amz-id-2: p9caGrESjWYwkHsxUB/95tSAMOAWdfigQO7CUyIVO+HkWK6LxeSkGY+AhjJC0xfpQ02CliLtx7w=

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 39 KB
13 KB 146ms
21ms Script
text/javascript 2a02:2638:d::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-9c21"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 01 May 2023 15:15:23 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 65ms
15ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Thu, 20 Apr 2023 19:45:58 GMT
content-encoding: gzip
age: 847765
x-guploader-uploadid: ADPycdu0ofEeAAYzdW5Z96wZyLXgm23ax7D6-P-kRrnYYyzN40_lI7nGf6iRwNhdTCtUf4jMUk4Ic8OfTq9SQAz3Ia2XKw
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Fri, 19 Apr 2024 19:45:58 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012304132133000/ Frame 7AA0 222 KB
60 KB 209ms
80ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f5a74ea4fa94eaadca122239fe4031ac54bc6ccd5dc4324c2751ea86a943124

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61827
x-xss-protection: 0
server: sffe
etag: "1754d270d28e2ea6"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 7AA0 15 KB
6 KB 165ms
37ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85afe5d6b60132a4c60a797263462587cbedf641bf528a053b9a63753b7a53b8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5222
x-xss-protection: 0
server: sffe
etag: "8e65ad5048245435"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 7AA0 94 KB
28 KB 168ms
40ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87164df907b04e7cc17ecf6cc67fc70758df16f4abe9ae99fdbb24ff5d2ff3ca

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28942
x-xss-protection: 0
server: sffe
etag: "73bf4bf39cc8fedd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 7AA0 5 KB
2 KB 207ms
79ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f68c8c5b10569e4cfa7a8eb1f137a96a5a6b6623e02e24170d837afe8fe0842e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1921
x-xss-protection: 0
server: sffe
etag: "f061d9295cdc41bd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 7AA0 40 KB
13 KB 280ms
152ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3532a807c3416a321a14d2e03f65872f747837a3eb23aa8571304ca6ddc1bec4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 28 Apr 2023 10:20:55 GMT
age: 190468
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12962
x-xss-protection: 0
server: sffe
etag: "8013fcb40cf8ec28"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 27 Apr 2024 10:20:55 GMT

GET
DATA 200
OK truncated
/ Frame 7AA0 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb96ff4ec4eab3ad829d1553f190bf1acd97e88d17de54f1614e6fb54109499d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 11817230694285208062
tpc.googlesyndication.com/daca_images/simgad/ Frame 7AA0 71 KB
71 KB 77ms
39ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/11817230694285208062

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d092ff19d413c576b9d02b3d2ce1e1eb583d71ac2601543ef18d0e9f720dd24

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:15:33 GMT
x-content-type-options: nosniff
age: 61190
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72327
x-xss-protection: 0
last-modified: Thu, 09 Mar 2023 11:03:18 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 22:15:33 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7AA0 2 KB
3 KB 108ms
79ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:44:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59470
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 30 Apr 2023 22:44:13 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 7AA0 295 B
664 B 66ms
36ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 21:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 64415
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 30 Apr 2023 21:21:48 GMT

GET
H2

200

5741634688953437709
s0.2mdn.net/simgad/ Frame 7AA0
Redirect Chain

https://ad.doubleclick.net/ddm/ad/N4789.Google/B21030944.360656933;sz=1x1;ord=3265447473;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?
https://ad.doubleclick.net/ddm/ad/N4789.Google/B21030944.360656933;dc_pre=CMzt_-by0f4CFRXjuwgd-FwAgQ;sz=1x1;ord=3265447473;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=?
https://s0.2mdn.net/simgad/5741634688953437709

631 B
1 KB

172ms
59ms

Image
image/jpeg

2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5741634688953437709

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 23:52:44 GMT
x-content-type-options: nosniff
age: 55360
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 631
x-xss-protection: 0
last-modified: Sun, 30 Aug 2020 06:46:14 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Apr 2024 23:52:44 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:23 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://s0.2mdn.net/simgad/5741634688953437709
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 7AA0 0
0 123ms
122ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CymmCCoZOZKTDO8St-wba0qWABveBtb5vg-CvxJwRjIuFngsQASDln-4sYJXikIKgB6ABzNaWkgLIAQKpAvfVlw-_fLI-4AIAqAMByAMIqgTtAU_QRtgGYEY7VG7WpVwhsOo6MzdWn6lUHUpmsg7gKcDfbUikW_iE4AOy4fsMyEPV191OIzZDE3bbFc-JtfhonlN2ByKnnnvVGzG1VGzEgqUmglC7xMmpa6tThV-GVYDymxlxaWcH1CNPgn-LbgHLQQ54RpSuUOFhLlkTPpR0kMPERLSS1IEgRDwu-8zO-r7bb03nUX7dfVDsqGLwu1UYVrv87ABWZybWPjEAG-2Jz_oE403Tl3MRb_CNoWWBKXlInA9RxFi0SdLuf1Mf3GgiGgM-ZZTJsGYojJZuXmxLPIFrD-dc3Etj3Xvwz8ynIcAE-5XH2aIE4AQBoAYCgAecqentAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcEEMvdGtIIEQiA4YAQEAEYHTICqgI6AoBAgAoDyAsB2BMD0BUBmBYBgBcBshceChwIABIUcHViLTc1Mjg5NDkzODU5MDkwOTkYrosi&sigh=ikz6hGq5NtQ&uach_m=[UACH]&cid=CAQSSwBygQiD3A2puVyASm4OPBs6G-yMS2CkvkHxcsa1fNKXfuG4C6bg5QimyavcsgpNVs5ISjgfzBfJ_ueJKzA2jjl4jkQq_iIvC6yjghgB
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
329 B 31ms
31ms XHR
application/json 34.252.16.161
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.16.161 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-16-161.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: afca8c7886952f5543b3b55ea0fbda3e19239c8cd40ea696333bb5c5880fa138

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:23 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://earnme.club
cache-control: no-cache
x-server: 10.45.9.3
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
320 B 28ms
28ms XHR
text/plain 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://earnme.club
date: Sun, 30 Apr 2023 15:15:23 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 241 B
335 B 31ms
30ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: c9f39cd5a8a858728ceed2e8c19c20a31903b3cae44d67bdad6ee75e9068580c

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
via: 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 075ba5ca204f0299044fee05edf7cf91
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 241

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 116ms
27ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://earnme.club
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://earnme.club
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Sun, 30 Apr 2023 15:15:23 GMT
server: Google Frontend
vary: Origin
via: 1.1 google
x-cloud-trace-context: b8fece80a7f0f3add66fa052979c1f89

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&rid=esp&cc=1

85 B
202 B

146ms
145ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&rid=esp&cc=1
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 10ce5235b9c4936794b60caa8830bc5d4a37892f4061f2f97f183f9f6209eac5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-gIOEyj00TTJq485lLRkSo/aceyQ"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://earnme.club
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Sun, 30 Apr 2023 15:15:23 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://earnme.club
location: /esp?url=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012304132133000/ Frame 9E0B 222 KB
60 KB 165ms
134ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f5a74ea4fa94eaadca122239fe4031ac54bc6ccd5dc4324c2751ea86a943124

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61827
x-xss-protection: 0
server: sffe
etag: "1754d270d28e2ea6"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 9E0B 15 KB
5 KB 121ms
118ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85afe5d6b60132a4c60a797263462587cbedf641bf528a053b9a63753b7a53b8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5222
x-xss-protection: 0
server: sffe
etag: "8e65ad5048245435"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 9E0B 94 KB
28 KB 124ms
121ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87164df907b04e7cc17ecf6cc67fc70758df16f4abe9ae99fdbb24ff5d2ff3ca

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28942
x-xss-protection: 0
server: sffe
etag: "73bf4bf39cc8fedd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 9E0B 5 KB
2 KB 156ms
153ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f68c8c5b10569e4cfa7a8eb1f137a96a5a6b6623e02e24170d837afe8fe0842e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1921
x-xss-protection: 0
server: sffe
etag: "f061d9295cdc41bd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 9E0B 40 KB
13 KB 157ms
154ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3532a807c3416a321a14d2e03f65872f747837a3eb23aa8571304ca6ddc1bec4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 28 Apr 2023 10:20:55 GMT
age: 190468
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12962
x-xss-protection: 0
server: sffe
etag: "8013fcb40cf8ec28"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 27 Apr 2024 10:20:55 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9E0B 2 KB
3 KB 56ms
55ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:44:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59470
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 30 Apr 2023 22:44:13 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9E0B 295 B
353 B 55ms
55ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 21:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 64415
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 30 Apr 2023 21:21:48 GMT

GET
DATA 200
OK truncated
/ Frame 9E0B 220 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 039c7c741b7e5db216057b8f904b22cf32a60ecdfb4ca5325fb21708353a4712

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 5900712007677401315
tpc.googlesyndication.com/simgad/ Frame 9E0B 14 KB
14 KB 54ms
53ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5900712007677401315?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmLTVUPN_YuqNddcNrEgkQehhUSqA

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e0f6ce9b91b49e1854b7b6b74916e958e74782dbf0b455a625c28f94c4b64d90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 10:21:26 GMT
x-content-type-options: nosniff
age: 190437
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14623
x-xss-protection: 0
last-modified: Mon, 27 Mar 2023 18:45:13 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 27 Apr 2024 10:21:26 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 9E0B 0
0 83ms
83ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CMjXlCoZOZJz_NYXXzQailbDoC52zwJdwhJOv8K0R0fTxnY0OEAEgvszXamCV4pCCoAegAfGaoNAByAEC4AIAqAMByAMIqgTmAU_QGqoJxL6dAJBZTfKc8sUCzLzQe6T3YRj9zumf_5Jbr-TvFIgROpekK8pqHS3bK49QiNNWuDpgg7n6iBEfB-lKfIojdiMd-fuS8YxENi_yEQF8prqDVi30WLQfI96jFXkJx0o8Mqj-OldNOh_G2DuqhKCcBfAwAvozFW2KZTlDIuDA5d9Kf1bndNznMZ0mzYPOx5G4Z3n8OHEhZJU8dJft-UU5GVLOD0CLQ3ls2OURQJAI07yoM31j_ei0lx3JK41EvWHTO_6hqhfEVmG_wlDpcrK8tsxfwEs-yx3pmqrDPJPJPr-PwATo9cvuvgTgBAGSBQQIBBgBkgUECAUYBKAGAoAH9-TfrwKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAfIHBBCMvRzSCBEIgOGAcBABGB0yAusCOgKAQPIIG2FkeC1zdWJzeW4tNjIxNjUxOTk0MTQxMDkwMIAKA8gLAdgTDNAVAYAXAbIXHgocCAASFHB1Yi00NjIwMTc0MTczNjU1NTg5GMbdbQ&sigh=4PyvOovf3oM&uach_m=[UACH]&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H2 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 505F 6 KB
3 KB 43ms
34ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D9F1 6 KB
3 KB 36ms
35ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5627 6 KB
3 KB 35ms
35ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame B36F 6 KB
3 KB 39ms
36ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6AC7 6 KB
3 KB 36ms
35ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/162175/9439/ Frame 4224 208 KB
63 KB 39ms
7ms Script
application/javascript 2.19.228.187
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/162175/9439/pwt.js
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=62176a72a06fe80ba569d18f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.228.187 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-228-187.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e38a5c4d09ce22745e0111e294c8242d11361a3b3ad87398ec965e77fc909f7f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 01:02:05 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=35227
accept-ranges: bytes
content-length: 64272
expires: Mon, 01 May 2023 01:02:30 GMT

GET
H2 200 track
track1.aniview.com/ 0
97 B 107ms
106ms Image
text/plain 54.159.46.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track1.aniview.com/track?d=Chrome&cou=DE&cos=Windows&r=earnme.club&rs=earnme.club&sid=29551&t=1682867723&cip=185.213.155.187&sn=&tgt=0&osv=10&bv=112.0&brn=Chrome&wi=640&he=361&app=&AV_PUBLISHERID=62176a72a06fe80ba569d18f&test=&d64=b062ea8a6e5f4ef947293d8f2c1f8df9&d63=b062ea8a6e5f4ef947293d8f2c1f8df9&aafaid=&proto=https&uid=1682867723468-986875175828-001215-002-009118&cha=0.7&stagid=62790805abc41c4450002684&stplid=6278f4f0a7dd573d85421cad&d35=&d36=6.2.93&cb=42668093820&d39=&d65=&d66=&d73=&apppkg=&d9=1000&d37=realtime&pt=2&cmid=&cwid=&cvid=&AV_WIDTH=640&AV_HEIGHT=361&&ppid=62176a72a06fe80ba569d18f&nid=5e7b9048180bd02ded4b0937&pcid=6278fd47e6b0901a49776895&ncid=627a0e8f76eb182bd8758ee8&pasid=627a0ec5d3a48b4af3605f6c&e=request&cb=1682867723721&asid=63a987c1780a4b73f009af75%2C6332ef0a396c5d5aa40539b5%2C63be800fceff40770704ac05%2C63a987aaf31103e0780c6cb4%2C63f8664d825c19956e019a78%2C62fcc8551f0d537b70642b47%2C63be7ffa5d8c2fe0ed0149ab%2C6332ef55cd0fcf1ceb506cc4%2C62a9a26be8c62b7a753672a4%2C62a9a29da987b3169d027596%2C62a9a2daf85a765d16158238&ofpr=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C&fpo=%2C%2C%2C%2C%2C%2C%2C%2C%2C%2C&ri=1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1%2C1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.159.46.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-46-45.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:23 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012304132133000/ Frame 27D5 222 KB
60 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f5a74ea4fa94eaadca122239fe4031ac54bc6ccd5dc4324c2751ea86a943124

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61827
x-xss-protection: 0
server: sffe
etag: "1754d270d28e2ea6"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 27D5 15 KB
5 KB 43ms
41ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85afe5d6b60132a4c60a797263462587cbedf641bf528a053b9a63753b7a53b8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5222
x-xss-protection: 0
server: sffe
etag: "8e65ad5048245435"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 27D5 94 KB
28 KB 44ms
42ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87164df907b04e7cc17ecf6cc67fc70758df16f4abe9ae99fdbb24ff5d2ff3ca

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28942
x-xss-protection: 0
server: sffe
etag: "73bf4bf39cc8fedd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 27D5 72 KB
16 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e6a5449728ebfc51d230927f284d732366fc61d350d279b924ce91cdb79bc3d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16674
x-xss-protection: 0
server: sffe
etag: "0a4cd60deb386a0e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 27D5 5 KB
2 KB 47ms
45ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f68c8c5b10569e4cfa7a8eb1f137a96a5a6b6623e02e24170d837afe8fe0842e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 12:11:36 GMT
age: 443027
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1921
x-xss-protection: 0
server: sffe
etag: "f061d9295cdc41bd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 12:11:36 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012304132133000/v0/ Frame 27D5 40 KB
13 KB 48ms
46ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012304132133000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3532a807c3416a321a14d2e03f65872f747837a3eb23aa8571304ca6ddc1bec4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 28 Apr 2023 10:20:55 GMT
age: 190468
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12962
x-xss-protection: 0
server: sffe
etag: "8013fcb40cf8ec28"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 27 Apr 2024 10:20:55 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27D5 2 KB
2 KB 40ms
39ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:44:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59470
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 30 Apr 2023 22:44:13 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27D5 295 B
319 B 39ms
38ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 21:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 64415
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 30 Apr 2023 21:21:48 GMT

GET
DATA 200
OK truncated
/ Frame 27D5 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9acbf16da30c0fc66a31cfaafc9d2a14fac8eb5bacaf2707cb13a710ba53b667

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 bg.jpg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 27D5 87 KB
87 KB 45ms
44ms Image
image/jpeg 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/bg.jpg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23161342549fc0c8700e4547eab70c8578bdd13049a07d31aa690d3816f9a571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 25 Apr 2023 16:38:22 GMT
x-content-type-options: nosniff
age: 427021
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89530
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 24 Apr 2024 16:38:22 GMT

GET
H3 200 heartbeat.png
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 27D5 61 KB
61 KB 56ms
55ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/heartbeat.png

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

269db599f3d178bf0a66b0a57b690802bb9a9d23b5c46f7e24658237ea7957c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:57:18 GMT
x-content-type-options: nosniff
age: 69485
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61981
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 19:57:18 GMT

GET
H3 200 logo.svg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 27D5 7 KB
2 KB 76ms
75ms Image
image/svg+xml 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/logo.svg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1276b7ab7d47020184bac7356044920bd2e92c3c14860f9d30f8f8469fdedcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 07:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113116
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2437
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 07:50:07 GMT

GET
H3 200 headline.svg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 27D5 6 KB
2 KB 72ms
71ms Image
image/svg+xml 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/headline.svg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d24dba5883753b029f54ebe1540289f00d1381650f47d2ade5948b11d8ca1e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 01:42:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 135181
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1883
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 01:42:22 GMT

GET
H3 200 text.svg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 27D5 11 KB
3 KB 70ms
69ms Image
image/svg+xml 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/text.svg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96104e2bfc935f12dd30992ba51e7cff38995d1e3610c2e7319b3fa82b2ae529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 05:57:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119862
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3180
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 05:57:41 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 27D5 0
0 125ms
43ms Image
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRyRkduza7b4wxokSiBJ7B4jqwn5boWynRKVHtXQtVBnE4w7MsxwCODzbMCx49pEhn8Ma5mXThODebyFgNj40TxKSJv1g
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 27D5 0
0 79ms
79ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CwdHMC4ZOZK69BZKx-wbsg4H4DtX_u6BwocGZ2rwR2tkeEAEghveGJmCV4pCCoAegAcS7378CyAEJqQL31ZcPv3yyPuACAKgDAcgDCKoE9AFP0Ocp_EOIokEhJmRqqYL9-bINBh0zN40_H-mPZJYzeg8H_ygCfs8zyAk2n27UT0AYT5_IodUCkwBachjxtTJIqQ04eUnaVov8Z4lrk6S4GMhTFArIhOchsXWaEW6qgD2kqgu-VoYnHSDLR40TKUGxa-c0PTP_LRDU5xek4f7wFyQTt46WNKG04VHdvZnD1NLhexqUWl430w3USwTChshBrEf88oM__-seOP1aQ5fQloEljyydYkULBbAtCJvSBAX5QfhsiR-8QOsycUcGEbEA4wr5zUohz161NFk5YWjjCM6cRljb9g9miGtgwsT8hFqq02frwATSm_vtlATgBAGgBi6AB6TEoMABqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQ05UU0ggSCIjhgBAQARgdMgOqggE6AoBAgAoDyAsB2BMDiBQC0BUBgBcBshceChwIABIUcHViLTg1ODYyNjUwMTE2MjQxMDcYgdQc&sigh=W2zYVBPfIgE&uach_m=[UACH]&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&template_id=419
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 867D 624 B
374 B 163ms
77ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhD7ppe5BBjervHlATAB&v=APEucNVa2pyaWO3xv4isa7tlmJRXBdQpQYwiNYfOXfE8msvMQeOHSrXBhWRrf44amoWMTlfGmMGF7hRTfP9kk4frBV-bfw4BEMhAV-ILPITdsFxxdc6kWtqplqtbKIoIp44E8QJY4CDfVGFGvsVc556Fqm2NcjFRWwLNN8ntYJyKBf-jLdCFTUJf4ugLE01B3P-bTTPdQ-AUhveSVpgZ9d8SGJzeC85Iag

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:24 GMT
expires: Sun, 30 Apr 2023 15:15:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 505F 78 KB
27 KB 208ms
130ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 505F 42 B
63 B 222ms
144ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BcabV-H94_xgoUUD_GBMLYtjLs9dGztuq6c6yk92X-NpcIpJXsfkIHIJiDXm6kYGem-Zh4JsrIQtz67yeMxKjbgFiUNvcWhWV44_VFSjEj15rr2iw

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 505F 0
20 B 222ms
145ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=3284911444714764635&x=1&ct=77

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame 505F 12 KB
7 KB 113ms
27ms Script
text/javascript 37.157.5.132
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=63115208;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.132 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

fcf4046b2825d297d3cafd03ba5757b6fae51c7356c791664505f16454be09b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 7097
expires: -1

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 505F 3 KB
1 KB 42ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71679
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 19:20:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 505F 19 KB
8 KB 43ms
39ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7966
x-xss-protection: 0
server: cafe
etag: 10783182253924109600
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:01:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 505F 158 KB
49 KB 167ms
61ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49538
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682508732222081"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame D9F1 34 KB
13 KB 46ms
43ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/m_js_controller_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa7889a593298971ce988a1b6b8c084bcc4e4c12226261416bc89e8f8a661a5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:19:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46563
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13560
x-xss-protection: 0
server: cafe
etag: 1543082015515965664
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:19:20 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame D9F1 24 KB
6 KB 43ms
40ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 07:58:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26225
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 29 Apr 2024 07:58:18 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D9F1 158 KB
48 KB 223ms
117ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49538
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682508732222081"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/ Frame D9F1 22 KB
9 KB 43ms
40ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/abg_lite_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec81013fada9e239bb9d91316ba5cdfffaf0f7a1ea4220ae81c271db75b71a5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 10:51:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15818
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8751
x-xss-protection: 0
server: cafe
etag: 8024400250147624166
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 10:51:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame D9F1 3 KB
1 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 19:20:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame D9F1 19 KB
8 KB 44ms
41ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7966
x-xss-protection: 0
server: cafe
etag: 10783182253924109600
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:01:09 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0BF0 0
136 B 154ms
76ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXkFSf0xnpW0ZN9oY76Cj76jRpxTD1UmqZ0eLAvfBJ9esxbikZzuBUumPmTGtt1Rqx_Cl_oNckqZOLn9BpwuqRPDcvgEw

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:24 GMT
expires: Sun, 30 Apr 2023 15:15:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 5627 78 KB
27 KB 304ms
235ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5627 42 B
63 B 213ms
144ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CFGz20bW2BVFBS5_8GBug5NHNW-1UQ-MLW8fsre6keMNZfFwjfvK1JWP5nTpLPPu85T00OxAlgR4Dd5uGZFHVTsmh8sKJCEkrBrUKpRadpPLbeM1c

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5627 0
20 B 213ms
145ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=18180370243886702978&x=1&ct=76

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 5627 3 KB
1 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71679
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 19:20:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 5627 19 KB
8 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47654
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7966
x-xss-protection: 0
server: cafe
etag: 10783182253924109600
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:01:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5627 158 KB
48 KB 261ms
165ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49538
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682508732222081"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A558 0
453 B 136ms
76ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiP9b7cATAB&v=APEucNWO8Nk28T-gnxtCm-BJEsBLnhT2URZ89cliUr_-Qmz5vWlnG7RHQZnEn-0GGZbJlMZFPUfXd7tRsxpHv5fB56oB2on6iQ

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:24 GMT
expires: Sun, 30 Apr 2023 15:15:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 822F 78 KB
27 KB 284ms
232ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 822F 3 KB
1 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/window_focus_fy2021.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 19:20:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 822F 19 KB
8 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7966
x-xss-protection: 0
server: cafe
etag: 10783182253924109600
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:01:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 822F 158 KB
48 KB 256ms
175ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49538
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682508732222081"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 822F 42 B
63 B 196ms
146ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dao__Zfvj_RKoFuCBlBW5QhGbG8femyoKThy1ZCMyiMlp7i2bX8arKLK9BVSgZ7TUW2_MwJ5DetJqyuGft8IWKVMFiO8wmkmCyF9ljdg6S3IvSi-s

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 822F 0
20 B 195ms
145ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1578542443098544751&x=1&ct=76

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 6AC7 5 KB
732 B 72ms
72ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

831997ce334905a4fc3c7f0673c30bd34701f9810d87b19335aea228804ae38a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 13:38:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0697 9 KB
1017 B 45ms
45ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

400fabe35a47597142482001174f415493a18dc7e1d35f2f66385013b7dd1e02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 30 Apr 2023 13:36:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 0697 2 KB
771 B 38ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:09:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68779
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:09:05 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/ Frame 0697 22 KB
9 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/abg_lite_fy2021.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ec81013fada9e239bb9d91316ba5cdfffaf0f7a1ea4220ae81c271db75b71a5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 10:51:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15819
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8751
x-xss-protection: 0
server: cafe
etag: 8024400250147624166
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 10:51:45 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 0697 3 KB
1 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/window_focus_fy2021.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 19:20:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 0697 19 KB
8 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7966
x-xss-protection: 0
server: cafe
etag: 10783182253924109600
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:01:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0697 158 KB
48 KB 200ms
151ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49538
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682508732222081"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H2 200 dc885651c24f3a38cf2b2dda4c5c7197.js Show response
www.gstatic.com/mysidia/ Frame 0697 32 KB
14 KB 119ms
35ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/dc885651c24f3a38cf2b2dda4c5c7197.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14c77f954be37da1e7fba8efd1279e7ece7e384d33b8375d6e6a1ce013daaf47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 25 Apr 2023 00:42:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 484359
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13586
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 00:18:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 24 Jul 2023 00:42:45 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/ Frame 6AC7 19 KB
8 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0761599a569a3a6c03de9e05afc2cf135fb6581abb26c89b3615f46988b31fad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:31:57 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67407
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8031
x-xss-protection: 0
server: cafe
etag: 4566461469134147509
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:31:57 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 6AC7 205 B
294 B 121ms
45ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 12:29:27 GMT
x-content-type-options: nosniff
age: 9957
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 29 Apr 2024 12:29:27 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 6AC7 604 B
918 B 118ms
43ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 13:27:48 GMT
x-content-type-options: nosniff
age: 6456
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Mon, 29 Apr 2024 13:27:48 GMT

GET
H3 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/022304132133000/ Frame 1EF0 222 KB
60 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022304132133000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d1ced72911892365fa799b44af92240a646d2a3b3ae47a8327a4ecda27bdd3bf

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 23:10:18 GMT
age: 403506
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61769
x-xss-protection: 0
server: sffe
etag: "92d474e178b13d24"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 23:10:18 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/022304132133000/v0/ Frame 1EF0 15 KB
5 KB 81ms
80ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022304132133000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

85afe5d6b60132a4c60a797263462587cbedf641bf528a053b9a63753b7a53b8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 17:20:41 GMT
age: 424483
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5222
x-xss-protection: 0
server: sffe
etag: "8e65ad5048245435"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 17:20:41 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/022304132133000/v0/ Frame 1EF0 94 KB
28 KB 82ms
82ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022304132133000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87164df907b04e7cc17ecf6cc67fc70758df16f4abe9ae99fdbb24ff5d2ff3ca

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 17:17:28 GMT
age: 424676
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28942
x-xss-protection: 0
server: sffe
etag: "73bf4bf39cc8fedd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 17:17:28 GMT

GET
H3 200 amp-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/022304132133000/v0/ Frame 1EF0 72 KB
16 KB 100ms
99ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022304132133000/v0/amp-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e6a5449728ebfc51d230927f284d732366fc61d350d279b924ce91cdb79bc3d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 17:20:34 GMT
age: 424490
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16674
x-xss-protection: 0
server: sffe
etag: "0a4cd60deb386a0e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 17:20:34 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/022304132133000/v0/ Frame 1EF0 5 KB
2 KB 93ms
92ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022304132133000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f68c8c5b10569e4cfa7a8eb1f137a96a5a6b6623e02e24170d837afe8fe0842e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 17:20:41 GMT
age: 424483
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1921
x-xss-protection: 0
server: sffe
etag: "f061d9295cdc41bd"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 17:20:41 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/022304132133000/v0/ Frame 1EF0 40 KB
13 KB 94ms
93ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/022304132133000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3532a807c3416a321a14d2e03f65872f747837a3eb23aa8571304ca6ddc1bec4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 25 Apr 2023 17:19:49 GMT
age: 424535
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12962
x-xss-protection: 0
server: sffe
etag: "8013fcb40cf8ec28"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 24 Apr 2024 17:19:49 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1EF0 2 KB
2 KB 38ms
38ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:44:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59471
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 30 Apr 2023 22:44:13 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 1EF0 295 B
330 B 39ms
39ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 21:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 64416
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 30 Apr 2023 21:21:48 GMT

GET
DATA 200
OK truncated
/ Frame 1EF0 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ccfb166b430d87f842c6d0675181a9e8f6be8a9c1a3c074f2eb80409d96865a0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 bg.jpg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 1EF0 87 KB
87 KB 39ms
39ms Image
image/jpeg 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/bg.jpg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23161342549fc0c8700e4547eab70c8578bdd13049a07d31aa690d3816f9a571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 25 Apr 2023 16:38:22 GMT
x-content-type-options: nosniff
age: 427022
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89530
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 24 Apr 2024 16:38:22 GMT

GET
H3 200 heartbeat.png
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 1EF0 61 KB
61 KB 49ms
41ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/heartbeat.png

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

269db599f3d178bf0a66b0a57b690802bb9a9d23b5c46f7e24658237ea7957c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:57:18 GMT
x-content-type-options: nosniff
age: 69486
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61981
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 19:57:18 GMT

GET
H3 200 logo.svg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 1EF0 7 KB
2 KB 52ms
45ms Image
image/svg+xml 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/logo.svg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b1276b7ab7d47020184bac7356044920bd2e92c3c14860f9d30f8f8469fdedcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 07:50:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 113117
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2437
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 07:50:07 GMT

GET
H3 200 headline.svg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 1EF0 6 KB
2 KB 53ms
45ms Image
image/svg+xml 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/headline.svg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d24dba5883753b029f54ebe1540289f00d1381650f47d2ade5948b11d8ca1e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 01:42:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 135182
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1883
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 01:42:22 GMT

GET
H3 200 text.svg
tpc.googlesyndication.com/sadbundle/10706763054857614767/images/ Frame 1EF0 11 KB
3 KB 53ms
46ms Image
image/svg+xml 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/10706763054857614767/images/text.svg

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96104e2bfc935f12dd30992ba51e7cff38995d1e3610c2e7319b3fa82b2ae529

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 05:57:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 119863
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3180
x-xss-protection: 0
last-modified: Fri, 28 Oct 2022 13:14:35 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 28 Apr 2024 05:57:41 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 1EF0 0
0 89ms
81ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CWCh-C4ZOZKPMGqq5-wac9rOwA9X_u6BwocGZ2rwR2tkeEAEg5Z_uLGCV4pCCoAegAcS7378CyAEJqQL31ZcPv3yyPuACAKgDAcgDCKoE8QFP0Pn5kYK6Ic13fCXWaB0_kt5uQOddUaS06aWog_8LtyuyWkN3Hgru8bBPK0fw2n2cE62vttjpTJY6HY4gfVhSCs3-WcmWXU7qE0jVhL6g7IMxebbWjIptDJvIAiSG2w2cnu5wlTBYl41ujrA7XhTiBotV0IAbFaySfw-QQOODybTvX2lSrUoh0qSBZXjGUVT0001wvo2rv-x9T0xc8mIhk7G9NFYxOQSuJ6VGF7YPNdyDA9siUtq2MHRKixmQ22IcUE8Nzga1iAxl1nbkAciEw_Fj_XJknabuvEYMwHDTlu0Exs-ghcUhXFWenKchZ1nWwATSm_vtlATgBAGgBi6AB6TEoMABqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwDyBwQQwP0a0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwHYEwOIFALQFQGAFwGyFx4KHAgAEhRwdWItNzUyODk0OTM4NTkwOTA5ORiuiyI&sigh=xfOBQdHOOUQ&uach_m=[UACH]&cid=CAQSSwBygQiDyCcIwmLtKGR5MlFvve8fk5us7HyOD5LspbzJx5R8tqkFy9uwY5712hgZ24WxwSisGFmZPkdpazXUbcPugzxltp1SGNVowRgB&template_id=419
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 7FC0 15 KB
6 KB 19ms
18ms Document
text/html 2a02:2638:d::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=earnme.club

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

97cf4206e208ceee4baa88c1d02f47176d84c5c84f85f63bca9d23aa9f077dc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:23 GMT
server: Kestrel
server-processing-duration-in-ticks: 402763
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 9D71 13 KB
5 KB 39ms
38ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 10523
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 12:20:01 GMT
expires: Mon, 29 Apr 2024 12:20:01 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame FB1A 783 B
1002 B 47ms
46ms Document
text/html 2a00:1450:4001:80e::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5c2b8ed90ea508fe635e1158f1b465577b0b6080034df19f7ee1268cc4df50da

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-2Zz0DWJiK2OdKcGxWBfzGw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-2Zz0DWJiK2OdKcGxWBfzGw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:24 GMT
expires: Sun, 30 Apr 2023 15:15:24 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H/1.1

200

pv Show response
tra.neodatagroup.com/
Redirect Chain

https://tra.neodatagroup.com/pv?sid=2033&rnd=1324546367370&id=11931&ad=122499&rs=1600x1200&lg=en-US&tz=0&ur=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&re=&co=24&cb=window._exaudiadapex.set...
https://tra.neodatagroup.com/pv?sid=2033&rnd=1324546367370&id=11931&ad=122499&rs=1600x1200&lg=en-US&tz=0&ur=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&re=&co=24&cb=window._exaudiadapex.set...

232 B
1 KB

82ms
81ms

Script
application/javascript

20.101.38.191
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://tra.neodatagroup.com/pv?sid=2033&rnd=1324546367370&id=11931&ad=122499&rs=1600x1200&lg=en-US&tz=0&ur=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&re=&co=24&cb=window._exaudiadapex.setNeoIdLastSync(%27@@neo_user_id@@%27);&pbs=true&neoid=30fa5773f9005dd
Protocol: HTTP/1.1
Server: 20.101.38.191 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: f9a760b72c5e5af453d5718db618d44d80dcbd2f76d074267b8e9147545e9bcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:24 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
vary: accept-encoding
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"; policyref="/ad/w3c/p3p.xml"
Access-Control-Allow-Origin: *
Content-Type: application/javascript;charset=UTF-8
Connection: keep-alive

Redirect headers

Access-Control-Allow-Origin: *
Location: /pv?sid=2033&rnd=1324546367370&id=11931&ad=122499&rs=1600x1200&lg=en-US&tz=0&ur=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&re=&co=24&cb=window._exaudiadapex.setNeoIdLastSync(%27@@neo_user_id@@%27);&pbs=true&neoid=30fa5773f9005dd
Date: Sun, 30 Apr 2023 15:15:24 GMT
Content-Type: text/richtext;charset=UTF-8
Connection: keep-alive
Content-Length: 0
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"; policyref="/ad/w3c/p3p.xml"

GET
H/1.1 200
OK js Show response
pixel.mathtag.com/sync/ 2 KB
2 KB 58ms
21ms Script
text/javascript 88.221.168.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/sync/js?sync=auto&mt_exid=10082&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370
Requested by: Host: c.neodatagroup.com
URL: https://c.neodatagroup.com/adapex.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.207 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-207.deploy.static.akamaitechnologies.com
Software: MT3 830 785530e master cdg-pixel-x15 config_version:"unknown" /
Resource Hash: 474abb3512d312b2b544ddfc9ea0de72c38df6f92810d2219c6c7e609f867a76

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:24 GMT
Server: MT3 830 785530e master cdg-pixel-x15 config_version:"unknown"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: text/javascript
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 1567
Expires: Sun, 30 Apr 2023 15:15:23 GMT

GET
H/1.1

200

cm
tracker.neodatagroup.com/
Redirect Chain

https://secure.adnxs.com/getuid?https://tracker.neodatagroup.com/cm?sid=1&pv=APN&eid=$UID&rt=img&rnd=1324546367370
https://tracker.neodatagroup.com/cm?sid=1&pv=APN&eid=1876879530974592077&rt=img&rnd=1324546367370

1 B
1 KB

89ms
45ms

Image
image/gif

20.101.38.191
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tracker.neodatagroup.com/cm?sid=1&pv=APN&eid=1876879530974592077&rt=img&rnd=1324546367370
Protocol: HTTP/1.1
Server: 20.101.38.191 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sun, 30 Apr 2023 15:15:24 GMT
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Content-Length: 1
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"; policyref="/ad/w3c/p3p.xml"

Redirect headers

Date: Sun, 30 Apr 2023 15:15:24 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8c867d3e-074b-45ee-b420-e49c1ebd0a86
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://tracker.neodatagroup.com/cm?sid=1&pv=APN&eid=1876879530974592077&rt=img&rnd=1324546367370
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

cm
tracker.neodatagroup.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=neodata_dmp&google_cm&pv=dbm&sid=1&rt=img&rnd=1324546367370
https://tracker.neodatagroup.com/cm?pv=dbm&sid=1&rt=img&rnd=1324546367370&google_gid=CAESEDpDtGnNTkibeOT2bO2_oPk&google_cver=1

1 B
1 KB

40ms
31ms

Image
image/gif

20.101.38.191
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tracker.neodatagroup.com/cm?pv=dbm&sid=1&rt=img&rnd=1324546367370&google_gid=CAESEDpDtGnNTkibeOT2bO2_oPk&google_cver=1
Protocol: HTTP/1.1
Server: 20.101.38.191 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sun, 30 Apr 2023 15:15:24 GMT
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Content-Length: 1
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"; policyref="/ad/w3c/p3p.xml"

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://tracker.neodatagroup.com/cm?pv=dbm&sid=1&rt=img&rnd=1324546367370&google_gid=CAESEDpDtGnNTkibeOT2bO2_oPk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 343
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
265 B 98ms
30ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=neodata&ttd_tpi=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

204

cms
ups.analytics.yahoo.com/ups/58681/
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=NDATA&rt=img&rnd=1324546367370
https://ups.analytics.yahoo.com/ups/58681/cms?partner_id=NDATA&rt=img&rnd=1324546367370

0
125 B

94ms
8ms

Image
text/plain

3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58681/cms?partner_id=NDATA&rt=img&rnd=1324546367370

Protocol

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.25 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

date: Sun, 30 Apr 2023 15:15:24 GMT
strict-transport-security: max-age=31536000
via: http/1.1 spdc0105.pbp.ir2.yahoo.com (ApacheTrafficServer)
server: ATS
content-language: en
location: https://ups.analytics.yahoo.com/ups/58681/cms?partner_id=NDATA&rt=img&rnd=1324546367370
content-type: text/html
cache-control: no-store
content-length: 369

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 867D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhD7ppe5BBjervHlATAB&v=APEucNVa2pyaWO3xv4isa7tlmJRXBdQpQYwiNYfOXfE8msvMQeOHSrXBhWRrf44amoWMTlfGmMGF7hRTfP9kk4frBV-bfw4BEMhAV-ILPITdsFxxdc6kWtqplqtbKIoIp44E8QJY4CDfVGFGvsVc556Fqm2NcjFRWwLNN8ntYJyKBf-jLdCFTUJf4ugLE01B3P-bTTPdQ-AUhveSVpgZ9d8SGJzeC85Iag
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:24 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 867D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZE6GDJ-Pi64HlRl2nlTPeAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhD7ppe5BBjervHlATAB&v=APEucNVa2pyaWO3xv4isa7tlmJRXBdQpQYwiNYfOXfE8msvMQeOHSrXBhWRrf44amoWMTlfGmMGF7hRTfP9kk4frBV-bfw4BEMhAV-ILPITdsFxxdc6kWtqplqtbKIoIp44E8QJY4CDfVGFGvsVc556Fqm2NcjFRWwLNN8ntYJyKBf-jLdCFTUJf4ugLE01B3P-bTTPdQ-AUhveSVpgZ9d8SGJzeC85Iag
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:24 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPl2fTlFxcqUSjOZPVf7D70&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 867D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIgvsSD80rFV30_a1nnzKRk&google_cver=1

43 B
1 KB

68ms
68ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIgvsSD80rFV30_a1nnzKRk&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhD7ppe5BBjervHlATAB&v=APEucNVa2pyaWO3xv4isa7tlmJRXBdQpQYwiNYfOXfE8msvMQeOHSrXBhWRrf44amoWMTlfGmMGF7hRTfP9kk4frBV-bfw4BEMhAV-ILPITdsFxxdc6kWtqplqtbKIoIp44E8QJY4CDfVGFGvsVc556Fqm2NcjFRWwLNN8ntYJyKBf-jLdCFTUJf4ugLE01B3P-bTTPdQ-AUhveSVpgZ9d8SGJzeC85Iag

Protocol

HTTP/1.1

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:24 GMT
AN-X-Request-Uuid: c37ac9dd-4ce8-4d1d-8c90-e4a73b0e70d8
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIgvsSD80rFV30_a1nnzKRk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 867D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTg3Njg3OTUzMDk3NDU5MjA3Nw%3D%3D

170 B
188 B

48ms
48ms

Image
image/png

216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTg3Njg3OTUzMDk3NDU5MjA3Nw%3D%3D

Requested by

Protocol

Server

216.58.212.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f162.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 30 Apr 2023 15:15:24 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 434a8e7f-eb8f-4036-b1fd-e2e3727cef1b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTg3Njg3OTUzMDk3NDU5MjA3Nw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 7AA0
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

44ms
44ms

Image
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Redirect headers

date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 9E0B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

50ms
50ms

Image
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Protocol: H3
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Redirect headers

date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 gGw73cM0XlbQcYxrebeyhHViipiHTTDF_uY2kwvN_fiEAjx03DPL_7ld7jVliRelo4EW6mjCjJAHYRmtzZ0wMcVfy2CfmfQe=w1200-h628-rj-pd-pc0x00e9e9e9
lh4.googleusercontent.com/proxy/ Frame D9F1 179 KB
179 KB 137ms
36ms Image
image/jpeg 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lh4.googleusercontent.com/proxy/gGw73cM0XlbQcYxrebeyhHViipiHTTDF_uY2kwvN_fiEAjx03DPL_7ld7jVliRelo4EW6mjCjJAHYRmtzZ0wMcVfy2CfmfQe=w1200-h628-rj-pd-pc0x00e9e9e9

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

3ab57372577777ef6642a46321e4f051c0edbe332c0db18b00fc26c5c18ceeb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 14:18:25 GMT
x-content-type-options: nosniff
server: fife
age: 3419
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
content-disposition: inline;filename="unnamed.jpg"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 182908
x-xss-protection: 0
expires: Mon, 01 May 2023 14:18:25 GMT

GET
H2 200 16777426232892586058
s0.2mdn.net/simgad/ Frame D9F1 5 KB
5 KB 39ms
38ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/16777426232892586058

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b973a1fc6c2f5b494d0476015f47f5da42d1fd968310924e8c49f820a6c7eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 04:00:32 GMT
x-content-type-options: nosniff
age: 40492
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4788
x-xss-protection: 0
last-modified: Mon, 27 Feb 2023 14:10:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 29 Apr 2024 04:00:32 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame 7FC0
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=earnme.club&sn=ChromeSyncframe&so=0&topUrl=earnme.club&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=iZLea3xlam5GY1BtMXdMWXJQR1lySTVXVStWcVBZTXlMOG00M3hKcEtqYzFRYlZDckExL1Vpd3Z4Z1hqQU9LRmVwcjRCYjYvdEN1TEFIWFpKUnY4blI0UmtVMlQ2RWYwRzErOGZBYzhnQ2dEWWhHZU1UNzJDY0hmL2IrcV...

441 B
654 B

220ms
19ms

Fetch
application/json

178.250.7.13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=iZLea3xlam5GY1BtMXdMWXJQR1lySTVXVStWcVBZTXlMOG00M3hKcEtqYzFRYlZDckExL1Vpd3Z4Z1hqQU9LRmVwcjRCYjYvdEN1TEFIWFpKUnY4blI0UmtVMlQ2RWYwRzErOGZBYzhnQ2dEWWhHZU1UNzJDY0hmL2IrcVZPVG5nYWV1aHJtMzVJNHBjRTBreFl4TDlxVmhaUFJyL3NieW1ydGM4K2pTU0RRcmc0eDBUelc3aTMxL2FLWFpHaERGS2ZNY1FxVFhzSHBVUkJiZTRsL0FzTWFubTVJM1JoenIxcjRmLzdOeVc2TlJIUmZUdUw0U1lOdWNlcXM3R2gzUys3cjdxbE1HQ2N5NW1PZDVaUzBydnNLUTN4Zz09fA&cppv=2

Protocol

Server

178.250.7.13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

7f6adc9ebada7e6287736727e720e9f094413dc86d57bcb6f399dc459169529c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1692846
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=iZLea3xlam5GY1BtMXdMWXJQR1lySTVXVStWcVBZTXlMOG00M3hKcEtqYzFRYlZDckExL1Vpd3Z4Z1hqQU9LRmVwcjRCYjYvdEN1TEFIWFpKUnY4blI0UmtVMlQ2RWYwRzErOGZBYzhnQ2dEWWhHZU1UNzJDY0hmL2IrcVZPVG5nYWV1aHJtMzVJNHBjRTBreFl4TDlxVmhaUFJyL3NieW1ydGM4K2pTU0RRcmc0eDBUelc3aTMxL2FLWFpHaERGS2ZNY1FxVFhzSHBVUkJiZTRsL0FzTWFubTVJM1JoenIxcjRmLzdOeVc2TlJIUmZUdUw0U1lOdWNlcXM3R2gzUys3cjdxbE1HQ2N5NW1PZDVaUzBydnNLUTN4Zz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 366293
content-length: 0
expires: 0

GET
H3 200 5900712007677401315
tpc.googlesyndication.com/simgad/ Frame 9E0B 14 KB
14 KB 43ms
41ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5900712007677401315?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmLTVUPN_YuqNddcNrEgkQehhUSqA

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e0f6ce9b91b49e1854b7b6b74916e958e74782dbf0b455a625c28f94c4b64d90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 10:21:26 GMT
x-content-type-options: nosniff
age: 190438
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14623
x-xss-protection: 0
last-modified: Mon, 27 Mar 2023 18:45:13 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 27 Apr 2024 10:21:26 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9E0B 2 KB
2 KB 40ms
38ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:44:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59471
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 30 Apr 2023 22:44:13 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 9E0B 295 B
330 B 42ms
40ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 21:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 64416
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 30 Apr 2023 21:21:48 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27D5 2 KB
2 KB 42ms
40ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 22:44:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59471
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sun, 30 Apr 2023 22:44:13 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 27D5 295 B
330 B 42ms
40ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012304132133000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 21:21:48 GMT
x-content-type-options: nosniff
server: cafe
age: 64416
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sun, 30 Apr 2023 21:21:48 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 505F 0
20 B 137ms
137ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2717992346735&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 505F 0
20 B 136ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2717992346735&version=m202301230201&ct=77&x=1&cor=3284911444714765000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 505F 28 KB
17 KB 86ms
82ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D5K4MeAa3JKG-ZNhJy6I92qUiITy5FgSA9bqsSSdABNX4VeQOt7-K8-h6XwemhcOPbM42xP3qCLc8yT2l_nxV9wVpoIU11tNQBcN5H-HieIIWr4gr18ZWDMH0LOV3WctGnt_zDk3ajoiZfiGy2txfMT1hk2737LnCGLgmVV_WYoa1ao-I&cry=1&dbm_d=AKAmf-CLVosdqm_ssd72pPjPVvplYFfT29f0lI2UZnIUPDSNufUUOh7pAlVqZwEXktF5qJXXeRhUyv_7UhlaVQsEgLbIBnNBqM-TykpYGB5RgkT0GfHAe4YOfzEAvTDxtHvAK1utqeOAWVOH0AtbRlFbKtDA6mfjgqOOMFMabdrGqmGsDc0zN4Tzzed8UIOXeJNyjRHMSrEdWL5Lpf_4Lan4qaevfX3Oaoz8fHCb-N34ITp4WLvxuvgrch___cXSmr8DwmDgri_KlvO1cEZ00Tc5v2_8bJC1i-3l0ls9sAehvxrwk0V3bubXIZC-39wYaBNNtpqY7wVt5RIjexKh_7cJE_lj8CCtMeLIeKNEVk-bCPh7e_c9sxHqVZ4Rk5aIGM76a0f8lpSRgpoCXQZO5cEzMCRXuCHY5lk0USO_4QCY1ft7EYnGkiXs5NhMiOBsRbc-JwjY290vwrmQrwcGCp_uQFkbPQoHJ4OZwBXh30Tf2H0pIWjkcdHJSoIiOncZGdrSzXnE7hKCh1TAk8_kCK1Ntj_66q5xbm7Ei7G-DLaAml6mDeIpsOWwzTUVJ3Z0rVq5eovhWRgDeSZJjOapUvmUjZTu5xuOjI-EDyK5GtsK0uDg1D9XagpF1MxKKAeC1ulmGFjphJ-8r3e7V1kWSu5-2D65mjbU4yPhOK-cxYoQerXywb1j7OXO4-XeHxo5hsET3Ch74xXohomNbdWd1D0Z5cU2CLsEQZ3sF3wjq21O3t5p13NgwvogWuQ-dCO-uBRhKMHoAy94g_7AEGEntgD6j-kO_ufMCwztYb_QP_DG-eMh0DU-jukFd5ADIlHeE4zSSego5PeL0BThLFMaQFoDVqigVUioVJ2PASpZJYuIq0BIsUqGL5kXKQhLzhXjQFEks-W_ARjwKOu2rzRZ2we5bWVpVuaJSHdntzqROkORXBfFnbQy5TADCXxyfYAY2XOhDNk7cBnPuNXNez8u52rNXCHUP8ahqbSvZRZocKqDS52oZhBbx6jIl4nY-DvGdvEgHD-l56dUDSU_c7GEp0FQCJPGUNkkN2yVBj3y9U_yQOlX7D-5cL64xXKlPptCuzPipPM4A2lUr1H5TcgO4ctY321BcgAoi1UOzd5Nk-ZhM6AikaC6o0SR8k1YHx55EkRGpcoBO1nJvWAGjwOU4HeH1onnat9MuTggZuk4qE0N2TwcmQ-mDvEUq2RF-j-HFVIk3VSHct7tGfn7Jz0dwuVjJbzWp3yFKNuGBC0EVbnarCuXMvyMzayTAzZPK80uR8sd39SJZ2qtR4bnw0uQ2COpDpkTx5fgPRKr7z8oCc4s2pC86t6s-LyA09QWDSWRJ4AuLmi27j_yiDVvG9I9u6BmIw8xssg-2xafgcbeAGHEq49xuimhxO8QAUczXLc7egiLBu-59Ov-rGBFFFgBSOKtkDN_PZrf7fSZce0lWmljvlrb5kOJ-WLELdM9DmfMjtspvqIk3J_Q3JJDVHyrRtXF7DiPXY6C1Sg03lFLulRuDEVhnCAqNDd7tQTwuT6KwANF82Bbojiz5mn6qiy0hxrsm7bcG0gwt3jcxQAtVi-OkWksQ_cad6Pl008Jp-mPaWxKt4vbmazGh3p5oXBTqBNoBylR7sy9Yg7IlxzWvNekoOm7RZcIrCPFzAtWUrUKN1NKlHnIPTz2ZhgBe72ji8ZMm9mFNlq-jLg1KWv1YOYUyOt7h_zpvnnBmX0n7tEpV0brjJD7aCN4D4dNpadXIphmq2ztt1EjlG78KEeHlye6HDU80EwdG53_H3RNvt611pN58Ddji3jaHlKq_NxVETgiy4_pXtWj3DrC9QHAgRnxrnPEG6fHzaYDk_aVl-QggrStnSjsdNPKo-FO5la_--BKnxncbEX5XiQxxb2PsWXngqFW_LL6pGGcFWrB3-Jt8J9RBv-u-jJGgCf8vJtiWjRuf8VBRv3zGNJpIRY4ahLqqyJFJlSW8nmfeTK9v6Jvkyh54EdjIWRJ1wihUt9tO8xW5_yEinVBNUf215iNE7qxCdPhvPlP2NZnbLX9RwxxjusthDi_UvPK37HuF0n_3NFiSFwrrryFk-DijKW-9aDccRsr-8mlF07BxBvPfbvrJT0dUG7xHoyweY2SUzjccKj36m_-3dKWi3IuZ8tLeoIw92RiwJmLqPQvDKd4BhynUeVvAuPgZMGbL3LqPDD7CaHiQglS4k2JHxLEwB7JdAtVpRzZPQ6rOi9m57w3Ezj6EWwRSbck4kQ9q8XhdjAUZG-dlLOxyaRMs5Lx6kX2tCdFfa8q3Tv4nPxYutEeil6m-ieAWN6y5bigfMRsFY4GESoL93qmOeOLg04wrEi0MtB7PKIO7ujrs08rTFqR3wDk1DfsNlJnOqkokWuJ6LnvYDA4fG4IWVbyhdPERVSly1dH7aMcAPSYISAo2W2TvzjA1-Rdku2NAobJpePQxEGdrHKjiH9Iso7uf5xSry2HQOKxfENl3HywzcyA2c9zaVWThsq4xoHgOAUojbN1tZAxnoFmPvY9upqOYxxIklCRmz3E--RnGOnD1CSCHfWI4h8alhAMd9rfXDHXIbAT123XENRv1u5scIsTqBMhCO0b9hwToborJUZaZ0qeTMqE7gIOcDObz0gF8GFJfFt3FPakruvppHOt49p3DiGvKOVZUlpX192PyRUzhXATaRWTdi7c5oq52PaHE--_ia0q_GJy5QKgm2gIWvLwBxl6onfpgURbuyncnmV0orMakaX-HRqllN_pecuw5yDcEZzOqWaZ7Z6dEcG2FVpkcJIBfJsPdhVoUpFHxiVB_z4Ppm0baXpS1zT3LUOWDoYOLPSITpTEdcySMX9kGhkRn0uQ-JDexTqfLxWw8b_dFFoLBqAA6fIItLAgTBAFen149JsuaJfAinpPOQYYmexomkWaCyl14-VpNIu3pkWZ6suMSw5Km08Va3sKJ7dZ9MjKBtvGQ2X1GxQbeVIAqcVXWwwuv_ujzARqHD2Mxi1KU_4Jo1NCJ6NclqcODybdABw1Q5vct7ZVEHkSM8IcpSx9gF8Pd4Kf0EZKzXl-PiouftPD6nY-onMHDphXQfJnF_0_iUvJBI9B9p1vPK2K2inFlNHGRgZdMPuf5YT6FiU7IrEyBR1oOy2kMq0Zb3gxFZJikUSJpmHIzJnLMypPQZphgHFoPAA9zCv92vUcEJFmkw-wDK2KZsiRHeoBVEOiDQmcKUgV-mQEe2U6oH39Z0VP2aRpL7gBygAtbFzTX3fRkdcOVLgQ6T13clZDVIyZl1GRnd-GjzMAFemp73tI40D4c6fGLoSHxDYpeisDEfQAcmEemHyA5sub0Vh64Qc7D6Tw2hSdpnIDzxjkM1yGchwqVBP_U-cvsR0cILMhyWqgnDm86odrptzZIty7lwWKvcmHgBLchyeXa8mLSewWJ_--fmVfryv6V3RW4kYuwaQH-8M7DF28EkvC8bpvozM3qN0qxnj-G2yDer0U6tltO4wBEGueHYtAHOWSAXwpiG2-sraG8pFBMJJoONj6or2cR_3WPbJtI3fGvd1Ppl_qNBRK8u-5f8RhKCw6EBiEx06ZXkM&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=3284911444714765000&adk=3047537735&idt=234&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cc4966dad7fc4704126cdf868f5ed8fdaff28f3ecd0268039cb18ad7cde06457

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16786
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 175D 0
91 B 51ms
27ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Sun, 30 Apr 2023 15:15:24 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D9F1 42 B
118 B 75ms
74ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ALjQUM6WPtqBbZXpv16-qniUjvkenqndCzGUjZ488_tyjxvLakGmU5r6apmr8md-06DEHjK1La_NpSln5xMKJSrY8_Ru6i3ACfaz9YKGXy4QBDBY0SdPcsKxH1WCYuEJoAFTXVR4PSaT0eDAmoMOfdW6U2aoaU5oCuVN4ta3bIWq6_ZfQ&cry=1&dbm_d=AKAmf-CkPiuWmUPzBueFMXCPvl84LX1uFR2LgeglAhCBpWtjRqSUCkV9SVulH8Tupt4cxhxfJ7uhbGB84jraRb4dGN50_8pw5zk235Km9t4QxnA-dfSdwl0YJb3i36be3Nr6UO8uIHsUJRZTR0HU0m4C0GWO6v9UrYgJfKjNj9qgJhDDkY3qAGz9L5Xb8dcZ53adNq-GsCaX0TMd1DlxOJOivNh-Rl_XQv27Tgq4ffapcun1DsJgb5L9rqLHAKAa5jXu58NodmE_qr0U8sqrEGxu_TmniY8XNRaLx8e_Rj5JEsnRHHRaVsC-aJLyEopy187zXL4jual9oGjI7xs_r305EJoQhI3eBDer3i7ufcmG6cTmnulUpMcXINAoyZJfYb2IyJ18F94h4HjQzv7E69Spr1lGBnQ-xetWGyBLW39TrWiKXloOWnG0z3WBLZ7IT-xhQ8Lpt2pVtvG0coroQbu03iuYLhKRqgvdOXOohYIcPga916f_qV5rSLVZHc755DEx2eqXO9Nd5kZJRf87iLe6Ty5nhYHl57RLiNloMHct2r07eWa7Ee0cKCvscNNQg60hxUJ8Hz9mKd2G2Tj0nuIh-gZ2QhbVGKv-tp-6RM1kkp5GXlPMuZkomlS4pJ0wYuj3KQHDMUosiDnJd5FWIK1vNH3y40CGyelUuLGW-HL0lVcmPd82LIxLKRXbKcERtVR6QijWU-pw92vRJ9jfQsqAvznfVr1ugfhlO1rvKBo0cvkL64TEsjap09mDbhop4HuSyYqGvizz8UwNdzEvW46LP0ffs-pt409OsBpeMnhHhZRrIBYsJPrqC-vCAi81TsF_n3-JZoQ3rTZ0cWXLZzfM3kzjpCSehCje87qCMQW2YeyLNF5RwbTPSaLjc8iBqqwW0G1irW7RhZP1hjAk7eXS9TPKlttpwPFILnEmcK6MhgrtfT--lHYmrJbA9OTEFlFwuBYlKnMWxIbSMtr-gvFOVVzVXRix12PY47DFltpHSXitArIPbD1jtQVzBfJvhbBaOd5_LUqJjY6J9KHcj16nX4FuhhPeS6B-AXR_nndUWtbVU1D_DGkUbhECVi2gtRkcf8ZQ6tvKwfpa13XOsqF9HkZTGn4IDZ-zsJ2fpJ2FgeViqy6kTRjruIXs9AVXvM1O-l9SQv2zQ_3-PCEe6uIxUlPuFPSn5h3vyejpghv8VSR24akn5UyYCob0B2ccP4o5zSdnbYfg7PCC0QcnjZ2G4djl_Q3EmAeLiBqCdqn52ab-ROQlEbPSGnJcGSuI-uEDjAjeRI_XDmtl02mspXo_2Hikh1Xhwh1W5hgZN2x4m1w3ARmMmSbSUJhZdjkarCceOan81S2CD1u31U4RQ6NEtf41T1GSOwRKYI46RkFoe3b6-OTqAfCPboOnVMqAfbO8LFSuljciYBrCXNLS6PQFp5X7T-GfHezcPg10lVEE8N2AxHJcX68kjcNRy0O_OX7USIYrYZWi-pZNXLiS4DRUta9rFGQa8Y_cKH849LK4-Siz-m70qyUYE7TZrl_aBmVK6w_TgG2Tasg-lEjJiA3AithnpRly4QMsHvb08n_1_RcuAXnauqL81TW0f5bApZJarvODs-Br5KTLyZa5bq5vXwHDjzBwRPh1Jv1fYAdt9NW4ou4tUO_Hh7dZwsN35XYjgIUyV0f945eCW7TTNAAr4eLUVlckBHIBs5Oy9UhhiQzXlzOVZ62J3toWb0-9S4n-MqbdxfYcrE11QndCwgYxlnvdKdLdgwFMwhvGv78adqjbAfNwN3ITS8UZ6cswk1DOBZRdLtfWE6XRy3VzNsqLq5Pw1mOkPtKdCJ0yrnh4vWuImx8qTN_GLHOdy3to2oAzkSeSw1MgSsUHZX33xLN3YJDqWgBpA3gBNM9OvkYqBTWILoJXn_aft8AzqURa0kHb9aM39mxo7L-2Pc-lHqR5hAvuP7zxiMgwv_BkY5ZJSZTzPuT9C0WOQAlX2x0fUjWfLxPkf6cugivF0mfBlMnQrv14xdTU0Wsa-luXqI0_3b378F3ksnnZN-PmM6_K7GWOtHTRiQCHrZKDyL3YHs6T2KzPOxe5iPm5y5gfTSeQlrbBQ_Cz2c8ePpwFceSmuiv3qvRcz0nlPRtUVAf0WV_gnv3cTRXFZ2TtRjBscfF_2pIOD8yMsyhyRBCGL_IBgBu6dpGpFMtWhlF35EWosakNhumcU_EtY_gmiLvFrKeLhQx4wupFgpbEtkJnm8idT0mv5Voex8TOeG71VPXyecQJueyUF_Pmys7dP7-_lFqIgR22GP8hEh1KMQ6zYe3In6GhxYqzWUtu_WDTjXsGSTNsX1dIo-4VdT7OgnHrEZpDhs5ZcISZ7KRuKPfxlLxd6HwYYAXEQRumvxy7uFLdsIE7i8R1HUaqurFA3yYydan11Etb9daEQiER5H8_qz0QdmE0r5ngmv-AEr9LWmcWw13tesVCfuexKAEipRtk2_J90bch_7Q9l26gGLv1MyA2zXSHfpbDifckKvYaiwskRjL8TIkqW7lrAL5NyNqeBeAPOLEUHgW9iTuZx_QQyv2l0YnUOsd_E_SfVilGZ3nMme1MJrztRTnEbCMrD6bdJHQ_4VgtWBtqsdOCviXO3NC6bR4knPGNphowmVjABfOKC-AaJzjwCXvrlKA6AIhwcomK9OBM3rZKoFcYfpfxa9bnd2T2dWpJp1EElMzvpn-MRUwZhY1Ib1CG5g-XJbdgLs-7PIWL6yPJBry2DCoFPM-89EQtl0aTU97-KS32zBRyruDismmcgaxMqZoiR8MBgUTs4K6Nhi5RRdqbzubtzoO-1nDHAGpmp7u8F76x0y0VlJUDWk3BtSdc2UTUKm_XtiW8e_NKi0RdcY4L945FuhSxKzkFqItCPZ3WatA-2AxKjeEPlBppZyvmoQNuX0quPJK55zrINZX2EWcZ-5mVk3uSUgsavI6wpC2M8l8WPfyP1MIsnfgbbyu8_N_d3Tp1nWk1uUK7jHc-JJxPCNpKQCTW5vUClo6ZvbqyqgDo74TxG8Y4S-xFJlMSMYzh2I5oZTwDw9GECbevtWNl4qh_RpemD0qIIQb6wCAv8l-edhj3CvC5phKP-bhsmcpa8k2RRjsIHU7fBHU8lOdk_REUjjKhQ7L72pRg_yQvgDA7c5rB9k_vYpYdsv7o0l4PEWO7CtiNct-fssbmumCNi8Vbh2y42qbGZuPY3Ok3G7zNpWpPBwBJ-mgYfevwnDfwL1iN8BlsPKc5B8RSgE5hRIB99T8wkIMLIbOM_Yhxwlskl0aQNxhz9a4HGMJ_g8NhrShTCBvnyXrnTMVgDFEr7HDx2RwQ9V6A3-5uBH5tu_fKSWvcZoaPfxKgmhiVznbYTXZtD9dguK0Zu0PaiGDvSUMzsEr8EVbeZyRhTTzqNkHwmTeVXFmjzCY6Ge0skPylSEIwvUmPFUO8jjVSRGGM0rHXgKqrYHkH8H7CiXMEMI98I9zbVE4SW2gjB09Dcc4ko2RI96FfEVolQP--50ASzo4_IOZgTKvK7aNpTBUsJOfkS4Mxc0Q9xPZKjK-Pyrn1Tcb5JhIBU09U0ODLakj9OZxmPTceTyc8CEiq5CJ9Uh6_THWp7__6KfYs1RV4yg&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&dc_exteid=31043430204575312209086888375092238&dc_pubid=4

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame D9F1 0
0 77ms
77ms Fetch
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CnBADCoZOZJ7_NYXXzQailbDoC_3vvPRvuPzys_YQZBABIL7M12pgleKQgqAHoAGSvOi9A8gBBqkC99WXD798sj6oAwGqBPEBT9ASHMvLBSikiCDbDovOzto_EZxRgbi-3lOPH6rAfIfG5Ri0pC8558yAs6J8C8rkExwe5ro60dxQWXYxVtY5JJSVOn6caK2njXwH6UeKHm94EjyNPVeAgYsFMm7n6fK8E1zIJTZmGoWDCBBV0jl9XFz6DrsXlSpGa-wit2l_apHh44YZ_XR-2MFHbE_e55aZuLwBG18GigFe6LpK5Y7BI6RlwH5GaodO-9vXKHtkpSRKtZbUwjUq1u5-LpO3r1rmW9rIVLo7jEmgI-ik6DB2IM1Lc_AoSyH3Q9-cJJoAFexv0PZ-bWeqxMZHYrMsSAAPnsAEpauegqAE4AQDiAW274fBSZIFBggDEAEYAZIFBggbEAEYAZIFCwgiEAIYAUjC5OoBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAY3gAfWw5dCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwoQpP8EGJzDmuIB0ggRCIDhgHAQARgdMgLrAjoCgEDyCBthZHgtc3Vic3luLTYyMTY1MTk5NDE0MTA5MDCACgPICwGwE52rjhPIE8u6-uED0BMA2BMKiBQC2BQB0BUBgBcBshceChwIABIUcHViLTQ2MjAxNzQxNzM2NTU1ODkYxt1t6BcB&sigh=uIpAwm-92I0&uach_m=[UACH]&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&template_id=509&vt=10
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H3 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8B82 6 KB
3 KB 36ms
36ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 822F 0
20 B 137ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2643281638827&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 822F 0
20 B 136ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2643281638827&version=m202301230201&ct=76&x=1&cor=1578542443098544600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 822F 70 KB
34 KB 73ms
72ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dl4oXpHUu7iNIvoI7mZz6TY5NC7QLnRjO0lzjE-ShltHumgnXp8alnZcwQc_OB51xXsR7HF-pSY4EJ9C80K06n90acQA&cry=1&dbm_d=AKAmf-B9FCeI329IZMrL4rjcq6rShFzQXYvc9BeMrwfGVGjipmT3rS-KU36sawF2aQsZJTDMEAGWAFWsSlHlmUKHDvxQgqGwc9NWGGmpFwErJP7VGUZDuNFS3JPUktZnge21jHUt9XMjgDT0_YQla8rP7N5LIvCDIpmIUx23tYMn3CP2TCng6M1VBresnrSFSHR5Ez2IRcoQApC6TvlQPXwMkVc8UlQSX0U3kclCcdx6zmoFtcGle_k4AWxmqO5elkkCRVOAXmhthGRz_0B7Cched_5H4dau9PRd1SZWfGoTl02BjxJl3UO35wcFjAgxpWZUf1hIwF8dB09nTSMe0mqGXkZe5eFRTItAP-C1wRWiuPId64N9Te5pBRUv3MBBtLcyqxkYu9pUbtwCwYS5PxwS6iYSG0STcIhYW_id7mJhy-dVc-Z6qxt1OB4pvbeJ4m11QZNXUtiOdq9tSK9kMBmusm5KE0PvtZLxOUfZcgR1-vpDkIaJ7VU-qbb9kYhGdhdJeDHv-wIqliLhMi6ZK4HRSwm2488R03qMTfG2TvnxCim6bd7c-fMRSAfGsh3Q39aX1uS2wnhoZMm58bkDX5j_0smvDceiJFU66eg79m5o6n7qXEXXY0CPNi5tPpP2ysE8NT7MmIjBulnbHEi34g6rVBypBUnzuNtrlKV1VKUXxUjRX_BwWl4anCgj3Ev7t7cBu9vcnvFkOxjCS575rRr68NTzl--LbvLX_3gbBFUv3THpWKZ-zU8fAKuTEiPOMYtaK1ywrg1TsRTEcBUClsy7uWimEzlhJsUMUjJvEgWJ7lyfvkkjcNdVZvyjZmjFkTzxwGM2yNCHqP8xS4ogkRntYeaHP3ZpJmP9QBZ1_ihKttNGuKF7_MM9-gW2_npJa5L-7sYHakMrcvteKzZMilrrmQYg3rDOU3pCd09z6t7juMKARRL0MqxxQpdAbyr5vfvf44liAXDiUpYZFVxgafcM6BIPNEieK62YjyeMjfSlY5dX7ahi8aHaaoCm5PaGULDC2RUmpPRBfVEr4z1dEWehN0en1mtDxzyCOnc2P8qpPlpbproMHhfMn-NnDFB8xnNkt_ojHw-Dr9Wcx5CWKgFT3OacK3Rprx3jD6k0RUrFMJSNALrrmJXuWvkLw8carcte_Fq0Jqh_s6Q8plb5fVykBn2R3S8zirMH-kY08U8WIm2xDMXchaaIZ_Yzwj9au7xwcwghSdb2K5JlwqVSC0EJdmm8sit1gSeXpUfVnU4y1JPVKgsqHWsUlU5SN7IDMP43gySnFIANOlO1N-pCMYReDc_r7SioCBpmDW2wAiE4U5hv8ZKfP-v3hJPOPOJqYBm5ZashKMo38wbwiPDzq40bLd1MaHVt5ZH_rUax5Y5oUxiygfkxmLkdgqRgRJIPKMbs7iLjudPe5jVXkQ_FYY7nmoZB7BHkuZgJDSqZB5M_vZbXE9_qgfpKupmjyELHWGeXXOPZKp2UyQ8sSfvJpi4v3aMfn0ABCjx0ICp9WbhCkgTLSOuxTpTatANTGTzRu7YkPJRgDgZ00ixeTpkNZD4Q5fno1McfDAsJY_P-Sl40tXbDGjqk1sQGZRUy7vnozE-HBjlsdtl82XRuSiicpuoavMFgp9Uc9MW0EaLYX9QnvrnN4qvqpDI55305TVqhoezzWLdcWsdUsKYYn21XfBMv1-Sz9dQ20K9SrkSSR4t1tLgdk0zAqrH2CGvOb0wuuz-x9tRfr0MIOuHfzEyXwfE2QNsbePl9ShANnKj_LV0-r-lZ3qAbWMyALCk9Is0hpR6fdmd0qxO3HKfWYFICnh6ymiuPPvN7kK68iNK-bT8EoHPcdvRc8176yDjBrdjLb5O1kI1vKGxCaZCyhchXk17s_rJg9nm-2dGe9u_rTvj4ZkYPC_Fcse0L6YbUyD1-6W8vT7piBWP7h4P8vlHDiCBMCEkqdJ40M0JqRjU9NjhsM7FZwlTxJeCISsPs6L4gjR4M6RPRFVifgOBBSP5cjunLzhqcCQ5EH29gBqi2iSEeAPNKAJkJwLP4dAEQhfqNAEPpPHsFyY_2Y9jXRMOXbGda6cKoQXcAvW-tVw1-SuktzPiu361LPGtnVd3fcyjUGRnA4Gv4YoQvcJSxVm1EPpm38dvwPgfEZvNN86OWXpp0OnsUq8nyjxzy_SIxgM6JCPobtgUmoF1usmn88WkhGDOw3yQ_GwFL-4leVSC180MmIc91PBxHwSZNRkLUQdxWv-Xb_J924-iBtkVXtwwjG3um7bbhwC9CZJjA-wD-fTCJxsyZ60tqEa2hd2EDWN8pGIdrBPgHwVxFSuOUzxnBvCbkj0DNnqToj9BNYe4__ddBnIxFc_N3V0Fb5V8lTzJGSLD1JlZ9uB_H9YRT9r0e7L4hfv-ukI41MGRqjB0kulByGvB362E1AAbC338UFOxwbZwiutkG984ypFbZTHlaLFmyZjhpFlxZbfg2waf0pjJtEXlzoYc4PIbLbXdI7Kdw0qVQzkiulJkvTp81BhH-8LwdRhZalvMhvyY1HZl9y3xQWClV5qThnI2qO83fFSRLjBKmIhX5w0f5YXKiwjezWMDuiW_UBOHTvzS2i5p8rxIMQfA4EQQOG5FVpqTg6s9ONfVpG9-8AxAueAjnsDwNADtkeXY2bn4HND7Fj_6519CnskhlGTxC94_REgUoarT09D1FYDBJZfcDvItt2RwGCrhhYWzRb7e46I-Gg8xsbXw3fQHsXO3LlROG3I19KjOjtoFJNgTDhxob8anqAv9Bd3gXug8k7mT2iPWHKst_Rg8l2LRYpr9bncpaPQYuwfi8Snx2Qiv0HSpYtYJPRAULtLEt328kESXBGDybAoxC3hC06sk_mMcWkqdtTab7WwxjeBHzDCiWaBSTt5hW9VIvvpOuMuxSgdl-KVD9p9w3Dy3oNdolQ1c4nqbaOsZZDinhRENM5l8-zXfYF3BU12TWp2s260joFL3G0RyBDJp7MYaBaXJSG0CG9zXeVyjnRaiR-4Y_3UI_pI0GZmim6c9SVZoJaYPl_isfMnsWpYooL3VapuVFKS3d6HwG42IaGL5ZaNMqS0Ipz2Fq-YqYj4A93WRj36fr7pfYzQ70Xep1nieNz2buuh93DVa0R7ui6vsxO4qrDe-YDd4oPutwWadHLnXEieNyAshwvvD5LhhFqxX0UKRViLfIYHnC2SqmyTn2in-kmFVVUJB2KiBtYgmYof2HO-iwiExxJeURAHlQ4cN2UX44Am_SRXL-0k9MKoVexdR-EB763Y8FQMNWDRe0uWpMPbIsfc9o8A17GAKhrGUBK83Tra5JLWXlGAElAhiMIH0JhabFh1QHZySKtjQbtwGwEhdGMTeItjsI6_5H6Ya5IilQyunqwtHUOiIjmkuclK0EPtDe-0qZQKkwJOw8Qnk0rhZ4JLai_o3y182mIc80_bUCQcaAeQ7jgaaoBFSG0-FE3OmY6b5jRpdaVsIweISJBXasaVJ_VzzAGG-fgG1YU6LNCtuv7FvpVHmY3tqBQCGvSvhz8ijpLS91Y6wp16evUjXxMtQlY7eX2SjEnodlSdroC863y-ZhjTe-U8JjagUKMDzKwwbH&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=1578542443098544600&adk=2988274607&idt=306&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3d3d23cbf6153d782e61702c972b533e5f359b4ca10b7979d29fd2289d2672e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34472
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5627 0
20 B 136ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=582803101358&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5627 0
20 B 137ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=582803101358&version=m202301230201&ct=76&x=1&cor=18180370243886703000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5627 70 KB
34 KB 97ms
96ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwL9G7kX7spY1Z4TT9lv_7qhwNJ6g69n4x2LvcrQ8HsocjaM410XYaI5Uig8R6Ukvanv8-zqPKBAkhTssZbodf3HqfgQ&cry=1&dbm_d=AKAmf-DbsfzbFneTX2bl6GN2HESwXwmHvGvds3SUTiEnl1i9i0Zvi7WLhJsUypbX3CHfoXQCY0oNVOHwLhihtJabIVbPRdkJRIo00B7W76459FW7st3r_bbVUlP2l_CXclJ8Ic3tNVGxI0qLiFzL-Wo4O_MK8Ysi6dmvWfR1vTvAT4ByAwUmpsWPoKnvJHHClFJFEbfnLj5qACFYcoS8-dVa3mdLGrP6-Eyb4bF0raegyZb0DC9WoGusdgJHgVbwPPRDshqEb3aqDcsTabcq_R9DPo9CstdPKpUAmsTATuZdWpvNnYtFjRF7mUjPPDuvClJwYdbF3v_R68WAmHQo0WcbGNTGega3oJ0Rdaq5JkqU-YU4aN3DIWKD-AiuHgmrrmO145H8BcMcCH7LxUiyQB3Tyov3OHZaoB4T2wiAvgmITid1T9OoToSttY4kdBMCDfbSqI6iPS5EsiDSicDPbA4hZ7bxu7te7bvg_FnjEG9F-LrvLg9mGDcmlBqSgGaF6aMRP5725VflUhcuIqvNrzROunM2nEU2JrpU3roGzY8AkPx4FlC8RhV3c-wLN28wyvJTGbMeP0T4FvQuVgCBFkAXZUwLBl1AqAA3qxUAIk3bVKGZRn_qnbsLnfc2wfH54yN4B5Y1iC50Ly08ms66v-yAXhsQ4hInmB3enGNJRSHeBAuaw8tZ-loSIPgpGQjQ5MyzWOJQntk3HHJxJYDpEkC9lm1gp1natqF9aMQVOHfj5b4NJsQk6r1D9RsOShzEF708jbC9curBBeNuJdAaBXGSeMqXT1ClnWKqIbgcueMcyzSE_JI8N3kFXIaeaW8MP2iYPtGf9s-bsCDBQFM-1_3J57FaQD41lFrNk55h9RdLVDKTxQkYwYh3hjU2uJuGbjkYby-ine0AUyMf2g9hAdws4_yCv_LWagEDahhFMfpONkK8jOXI4Iwu8OfeaFt8z-8zObF_w0Obhq7YPq7Mxb6-V5X3uR53rkSW4LvwmNzwCSdB-XKb0tZaZMtWKLInvegg_RipiQDk2NojjHWi-Y2SH9O5EbF6LEGRTf47dIrh50dkZpmu99vQYGswLXw5WagAEp5kXeB8yBYAWrbNh1czBR6qunYMjevRq3Wh60UKbU3PPe-gNWcvrurHF9O-WDhN4AHAf5VBn75mBhS3xVLzySUTZ9I-VRRWjnVF7-gC2sRuZAF8ANCwc2fPx9qvc-opItukqonzENA8W-_UaEwzj_XgmtrTRk8s0bBDngoCuTPOMfefFEli8e0iToDJzH2YldbH4RsBrgKZtqLy4Y4WOp-BI-MIgHOgLzb3KHSGL11MDSf9Cg_jfu7ly5dPImeX8mMRkLfkhbU3JsXh_tNxlbqCM1aelKhLPCgEzzhqh2iBr8R6e6Mdjemm7z1kj3Pk0qTR7QgBI-1P1WYeiXY8QukrJzBceBtfZQ3Gt0wEDqx63gRrfB9sOsLL5j5-rONMjwm1IPhs6zbwdU7o4JvrTWEmvCS6ihA-7GKKDKbWkNuPMNRPD4SyF3V-AE37I1qQx_FJmAmKpr3VB40AFE5c0w4Cn6SGgLJUpp3-AzHy9kkzShuUsRQ1yaaPzgLdIEsT1C2TNuFwxV0iwWJEhjD_Erlg6EdWIDA7sNLmjjl_RKEAM6TpoUv4Inc0xwlz3QWcA8MLjwq4uQRGbF6VDnPi7wUa68omIvu10--uiBFRzerAe5Z2Mol5gEu0ORNRL2zI7RS5qLnqh_R-TsZe2RZZwLTijr9onTdyDRq4YyolX7FE_01wRbm0e8Od-lL_t3f3FRFGAJEeivE04zxgnM4nKw3ysaQubNe1lIt3zojQWCLbOpFLb1eIX5KWW9-0ppfhW1FkXiVJlQCrTI5C-jHYfPJWPYSMXVR9S0O65XfqeftKCx0D17mNhRsloo9THULidHBrLz35XcIpPmztbCw7uYIiiqmTcfX732-4H7ndzwzYe1zqLt-9plsMUzQZ05lPvc2ZFOjxX1RyJpx9g6qi_iaX5ZBQrlW_W-R2A-9BS-C7G3eG-d1_5UxJdh-cji8i2Le6Kdr2x8mp0lwhMMsjY0T4bHkCdBE0IRk2JBDVWzR9qxoskFI3aTAcIWLITTBzYdaVJ4SZfQtzSXxu4_Kkb_9diDCiDP2mA4I75E6vMkzYPFsFUbXTSRTVgEv1UzmyPGS0Rc5EG3CmCLiXR6NvUgLJMD-D3iwoC3F2YHJlsJeMNkHWC2p3LaY0eJHPX3u8MRmH5S8pTWe1J1vF4bn-ga4FYEJyA1s5w3AOM84allIDdzQwfWL-4dLiU6lbLZaoqByQ3WTMk_uYIr0a_ANZ6ceF5CJnjF4zmadSTlEBny9ewrIRDOVfAC86OFzWtisAFCb6MKdC0C0_ayR2Oc3chgE3vjee3FgmXIx9tW3uvvc1P4YuCTxw8HToFj_nkD-jQ3o1tLLcDxHqYJEVxcDNei7OlwGKC_Lsww3DtWfxb-JggsI7aNlFirCa0-fHgaAGGMC5I-YVeRx5BOXM9CfqsiRLwl3jCW15K2w0XcFAjAVblOnBVw40qx38EQ12__xy3ALwjTCwmL9MnUcFgrFApTRjPUbzYAPltDSjEhoIs8jo4LznPhMg6hfah9jkHhOTnL4gBB045uCwKNKF_MaF-JIVHSHPr8eRU37xIa6bUQxS5t3lDIo3RnpuUn0Ubs0Gc9b-zFzM7zGQqDgU5K2wv1Peh5MuXJmRKejghg4a7Yi05PG3p-cJYL4g3bMcPm2cZErSYm8KCP7gRoTM-Ei4baKM2iHvMZ05yF8mx9qMnZYCNTpVNfBiDQT_HRIZKo6Z4tmLgx_enkU8QRtXBlG0Y7OYgp2EN3kxTDRo_VoDGqT9jdnLxPTdqSm-hXGlybKs8Nv4wIxu_ZJURY0HX1OcVkAJKq8g6S18KMaYTlpo1FrsfRlFbHWNSqshQJxfShCjqCjjMtrnOhnEnwxWEcgGHljkHTA4UhHHtYujJ1hc4ybRiHiT5kA3eG5BGTNckBlRcngshs9bqo5jZGnoJz-8_ZHOZMc14OFv-xObLGK8FTQA8MPu7ZlSUdxNcbhHGFItXiFCbL4_JpKz8GWnG1cagKewCSZRB5KCIYzUwIhk0o1vNQAic-IfhYVxDWi-jZDazsF5G1kvYSQGRZF06Mi7q5PioYct7BRWq0YDlj0kH50cX2AdIrKvZUD69R7Vt1jgJWe4_V1oQQFDu8tPVAH7aN3HHNSolhePU7BkRRCfA5McnMkH_h5Sycd7zZOHSrxhBAXOmLJEcvxnhMYa_EobXohVn4eR1XVaxn05vbCX7hPVB2xjLzaBU19hXUzpLWZcfabQmx32lHWONdm62piQcis3trxWgjGNVJu7o82Kl3iET-2nPAoHZ6Lg5IzbEcr3A_pB_yi5l4jo1ZEzAsbB1aWvo6inVJbtAzncg20sYbzuoN00wzaWcdimRLNIUrLautiuu6E164E7QTStznZNThybjvA4m9s9SxwwPvkvbB7hG1k0MbP809WMNFgEzG51_-imsWJ5WY0GGPs_uGEd00KumHVGlCdHcup_1w3KdxHt3_sTu1Vn-D0TBJUM5Oz8MEyzFxOu&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=18180370243886703000&adk=2086295851&idt=327&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd24954dc2ec5ed03a3020544184481c5d8e27ce2dd0a41e95d9fb4ec336ea54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8591 143 B
166 B 45ms
36ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 266
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:10:58 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 publishertag.prebid.135.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 183ms
183ms Script
text/javascript 2a02:2638:d::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.135.js

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.emc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 01 May 2023 15:15:24 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame FB1A 0
0 136ms
136ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202304250101&jk=1792785991261384&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame D9F1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0a09c2c6747041f3de17afb29923b231c27108e86cb4f3c370df29087f112f5b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/ Frame 505F 28 KB
11 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D5K4MeAa3JKG-ZNhJy6I92qUiITy5FgSA9bqsSSdABNX4VeQOt7-K8-h6XwemhcOPbM42xP3qCLc8yT2l_nxV9wVpoIU11tNQBcN5H-HieIIWr4gr18ZWDMH0LOV3WctGnt_zDk3ajoiZfiGy2txfMT1hk2737LnCGLgmVV_WYoa1ao-I&cry=1&dbm_d=AKAmf-CLVosdqm_ssd72pPjPVvplYFfT29f0lI2UZnIUPDSNufUUOh7pAlVqZwEXktF5qJXXeRhUyv_7UhlaVQsEgLbIBnNBqM-TykpYGB5RgkT0GfHAe4YOfzEAvTDxtHvAK1utqeOAWVOH0AtbRlFbKtDA6mfjgqOOMFMabdrGqmGsDc0zN4Tzzed8UIOXeJNyjRHMSrEdWL5Lpf_4Lan4qaevfX3Oaoz8fHCb-N34ITp4WLvxuvgrch___cXSmr8DwmDgri_KlvO1cEZ00Tc5v2_8bJC1i-3l0ls9sAehvxrwk0V3bubXIZC-39wYaBNNtpqY7wVt5RIjexKh_7cJE_lj8CCtMeLIeKNEVk-bCPh7e_c9sxHqVZ4Rk5aIGM76a0f8lpSRgpoCXQZO5cEzMCRXuCHY5lk0USO_4QCY1ft7EYnGkiXs5NhMiOBsRbc-JwjY290vwrmQrwcGCp_uQFkbPQoHJ4OZwBXh30Tf2H0pIWjkcdHJSoIiOncZGdrSzXnE7hKCh1TAk8_kCK1Ntj_66q5xbm7Ei7G-DLaAml6mDeIpsOWwzTUVJ3Z0rVq5eovhWRgDeSZJjOapUvmUjZTu5xuOjI-EDyK5GtsK0uDg1D9XagpF1MxKKAeC1ulmGFjphJ-8r3e7V1kWSu5-2D65mjbU4yPhOK-cxYoQerXywb1j7OXO4-XeHxo5hsET3Ch74xXohomNbdWd1D0Z5cU2CLsEQZ3sF3wjq21O3t5p13NgwvogWuQ-dCO-uBRhKMHoAy94g_7AEGEntgD6j-kO_ufMCwztYb_QP_DG-eMh0DU-jukFd5ADIlHeE4zSSego5PeL0BThLFMaQFoDVqigVUioVJ2PASpZJYuIq0BIsUqGL5kXKQhLzhXjQFEks-W_ARjwKOu2rzRZ2we5bWVpVuaJSHdntzqROkORXBfFnbQy5TADCXxyfYAY2XOhDNk7cBnPuNXNez8u52rNXCHUP8ahqbSvZRZocKqDS52oZhBbx6jIl4nY-DvGdvEgHD-l56dUDSU_c7GEp0FQCJPGUNkkN2yVBj3y9U_yQOlX7D-5cL64xXKlPptCuzPipPM4A2lUr1H5TcgO4ctY321BcgAoi1UOzd5Nk-ZhM6AikaC6o0SR8k1YHx55EkRGpcoBO1nJvWAGjwOU4HeH1onnat9MuTggZuk4qE0N2TwcmQ-mDvEUq2RF-j-HFVIk3VSHct7tGfn7Jz0dwuVjJbzWp3yFKNuGBC0EVbnarCuXMvyMzayTAzZPK80uR8sd39SJZ2qtR4bnw0uQ2COpDpkTx5fgPRKr7z8oCc4s2pC86t6s-LyA09QWDSWRJ4AuLmi27j_yiDVvG9I9u6BmIw8xssg-2xafgcbeAGHEq49xuimhxO8QAUczXLc7egiLBu-59Ov-rGBFFFgBSOKtkDN_PZrf7fSZce0lWmljvlrb5kOJ-WLELdM9DmfMjtspvqIk3J_Q3JJDVHyrRtXF7DiPXY6C1Sg03lFLulRuDEVhnCAqNDd7tQTwuT6KwANF82Bbojiz5mn6qiy0hxrsm7bcG0gwt3jcxQAtVi-OkWksQ_cad6Pl008Jp-mPaWxKt4vbmazGh3p5oXBTqBNoBylR7sy9Yg7IlxzWvNekoOm7RZcIrCPFzAtWUrUKN1NKlHnIPTz2ZhgBe72ji8ZMm9mFNlq-jLg1KWv1YOYUyOt7h_zpvnnBmX0n7tEpV0brjJD7aCN4D4dNpadXIphmq2ztt1EjlG78KEeHlye6HDU80EwdG53_H3RNvt611pN58Ddji3jaHlKq_NxVETgiy4_pXtWj3DrC9QHAgRnxrnPEG6fHzaYDk_aVl-QggrStnSjsdNPKo-FO5la_--BKnxncbEX5XiQxxb2PsWXngqFW_LL6pGGcFWrB3-Jt8J9RBv-u-jJGgCf8vJtiWjRuf8VBRv3zGNJpIRY4ahLqqyJFJlSW8nmfeTK9v6Jvkyh54EdjIWRJ1wihUt9tO8xW5_yEinVBNUf215iNE7qxCdPhvPlP2NZnbLX9RwxxjusthDi_UvPK37HuF0n_3NFiSFwrrryFk-DijKW-9aDccRsr-8mlF07BxBvPfbvrJT0dUG7xHoyweY2SUzjccKj36m_-3dKWi3IuZ8tLeoIw92RiwJmLqPQvDKd4BhynUeVvAuPgZMGbL3LqPDD7CaHiQglS4k2JHxLEwB7JdAtVpRzZPQ6rOi9m57w3Ezj6EWwRSbck4kQ9q8XhdjAUZG-dlLOxyaRMs5Lx6kX2tCdFfa8q3Tv4nPxYutEeil6m-ieAWN6y5bigfMRsFY4GESoL93qmOeOLg04wrEi0MtB7PKIO7ujrs08rTFqR3wDk1DfsNlJnOqkokWuJ6LnvYDA4fG4IWVbyhdPERVSly1dH7aMcAPSYISAo2W2TvzjA1-Rdku2NAobJpePQxEGdrHKjiH9Iso7uf5xSry2HQOKxfENl3HywzcyA2c9zaVWThsq4xoHgOAUojbN1tZAxnoFmPvY9upqOYxxIklCRmz3E--RnGOnD1CSCHfWI4h8alhAMd9rfXDHXIbAT123XENRv1u5scIsTqBMhCO0b9hwToborJUZaZ0qeTMqE7gIOcDObz0gF8GFJfFt3FPakruvppHOt49p3DiGvKOVZUlpX192PyRUzhXATaRWTdi7c5oq52PaHE--_ia0q_GJy5QKgm2gIWvLwBxl6onfpgURbuyncnmV0orMakaX-HRqllN_pecuw5yDcEZzOqWaZ7Z6dEcG2FVpkcJIBfJsPdhVoUpFHxiVB_z4Ppm0baXpS1zT3LUOWDoYOLPSITpTEdcySMX9kGhkRn0uQ-JDexTqfLxWw8b_dFFoLBqAA6fIItLAgTBAFen149JsuaJfAinpPOQYYmexomkWaCyl14-VpNIu3pkWZ6suMSw5Km08Va3sKJ7dZ9MjKBtvGQ2X1GxQbeVIAqcVXWwwuv_ujzARqHD2Mxi1KU_4Jo1NCJ6NclqcODybdABw1Q5vct7ZVEHkSM8IcpSx9gF8Pd4Kf0EZKzXl-PiouftPD6nY-onMHDphXQfJnF_0_iUvJBI9B9p1vPK2K2inFlNHGRgZdMPuf5YT6FiU7IrEyBR1oOy2kMq0Zb3gxFZJikUSJpmHIzJnLMypPQZphgHFoPAA9zCv92vUcEJFmkw-wDK2KZsiRHeoBVEOiDQmcKUgV-mQEe2U6oH39Z0VP2aRpL7gBygAtbFzTX3fRkdcOVLgQ6T13clZDVIyZl1GRnd-GjzMAFemp73tI40D4c6fGLoSHxDYpeisDEfQAcmEemHyA5sub0Vh64Qc7D6Tw2hSdpnIDzxjkM1yGchwqVBP_U-cvsR0cILMhyWqgnDm86odrptzZIty7lwWKvcmHgBLchyeXa8mLSewWJ_--fmVfryv6V3RW4kYuwaQH-8M7DF28EkvC8bpvozM3qN0qxnj-G2yDer0U6tltO4wBEGueHYtAHOWSAXwpiG2-sraG8pFBMJJoONj6or2cR_3WPbJtI3fGvd1Ppl_qNBRK8u-5f8RhKCw6EBiEx06ZXkM&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=3284911444714765000&adk=3047537735&idt=234&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

750d70bfb8a9982b827656699387de0b63da65b2e9a247768005d9775bad42b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10878
x-xss-protection: 0
server: cafe
etag: 6410051166583139006
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:07:47 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 505F 41 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 26 Apr 2023 14:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 346841
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Apr 2024 14:54:43 GMT

GET
H/1.1 200
OK iframe Show response
pixel.mathtag.com/sync/ Frame 960E 3 KB
1 KB 43ms
42ms Document
text/html 88.221.168.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=3069644e-860c-4b00-9b14-7db1a0fa86b9&no_iframe=1&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370&mt_exid=10082&source=mathtag
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/js?sync=auto&mt_exid=10082&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.207 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-207.deploy.static.akamaitechnologies.com
Software: MT3 830 785530e master cdg-pixel-x26 config_version:"unknown" /
Resource Hash: 84e386403ef04fab3349f1e01862b1313e49e5dbe66dba3acdbaa671515314fb

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 962
Content-Type: text/html
Date: Sun, 30 Apr 2023 15:15:24 GMT
Expires: Sun, 30 Apr 2023 15:15:23 GMT
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 830 785530e master cdg-pixel-x26 config_version:"unknown"
Vary: Accept-Encoding

GET
H3 200 C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js Show response
pagead2.googlesyndication.com/bg/ Frame C027 36 KB
14 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 09:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191857
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14118
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Apr 2024 09:57:47 GMT

GET
H3 200 container.html Show response
4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5A85 6 KB
3 KB 39ms
36ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:22 GMT
expires: Mon, 29 Apr 2024 15:15:22 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
www.youronlinechoices.com/wp-content/plugins/optout/callback/ 0
0 371ms
129ms Image
text/html 40.85.112.191
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youronlinechoices.com/wp-content/plugins/optout/callback/?status=nocookie&token=DkuKCTVT5dXo9sTVnMX_MGocaxg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 40.85.112.191 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ 0
492 B 27ms
27ms Image
image/gif 88.221.168.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.207 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-207.deploy.static.akamaitechnologies.com
Software: MT3 830 785530e master cdg-pixel-x16 config_version:"unknown" /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:24 GMT
Server: MT3 830 785530e master cdg-pixel-x16 config_version:"unknown"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Sun, 30 Apr 2023 15:15:23 GMT

GET
H3 200 C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js Show response
pagead2.googlesyndication.com/bg/ Frame 9D71 36 KB
14 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 09:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191857
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14118
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Apr 2024 09:57:47 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/ Frame 822F 28 KB
11 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dl4oXpHUu7iNIvoI7mZz6TY5NC7QLnRjO0lzjE-ShltHumgnXp8alnZcwQc_OB51xXsR7HF-pSY4EJ9C80K06n90acQA&cry=1&dbm_d=AKAmf-B9FCeI329IZMrL4rjcq6rShFzQXYvc9BeMrwfGVGjipmT3rS-KU36sawF2aQsZJTDMEAGWAFWsSlHlmUKHDvxQgqGwc9NWGGmpFwErJP7VGUZDuNFS3JPUktZnge21jHUt9XMjgDT0_YQla8rP7N5LIvCDIpmIUx23tYMn3CP2TCng6M1VBresnrSFSHR5Ez2IRcoQApC6TvlQPXwMkVc8UlQSX0U3kclCcdx6zmoFtcGle_k4AWxmqO5elkkCRVOAXmhthGRz_0B7Cched_5H4dau9PRd1SZWfGoTl02BjxJl3UO35wcFjAgxpWZUf1hIwF8dB09nTSMe0mqGXkZe5eFRTItAP-C1wRWiuPId64N9Te5pBRUv3MBBtLcyqxkYu9pUbtwCwYS5PxwS6iYSG0STcIhYW_id7mJhy-dVc-Z6qxt1OB4pvbeJ4m11QZNXUtiOdq9tSK9kMBmusm5KE0PvtZLxOUfZcgR1-vpDkIaJ7VU-qbb9kYhGdhdJeDHv-wIqliLhMi6ZK4HRSwm2488R03qMTfG2TvnxCim6bd7c-fMRSAfGsh3Q39aX1uS2wnhoZMm58bkDX5j_0smvDceiJFU66eg79m5o6n7qXEXXY0CPNi5tPpP2ysE8NT7MmIjBulnbHEi34g6rVBypBUnzuNtrlKV1VKUXxUjRX_BwWl4anCgj3Ev7t7cBu9vcnvFkOxjCS575rRr68NTzl--LbvLX_3gbBFUv3THpWKZ-zU8fAKuTEiPOMYtaK1ywrg1TsRTEcBUClsy7uWimEzlhJsUMUjJvEgWJ7lyfvkkjcNdVZvyjZmjFkTzxwGM2yNCHqP8xS4ogkRntYeaHP3ZpJmP9QBZ1_ihKttNGuKF7_MM9-gW2_npJa5L-7sYHakMrcvteKzZMilrrmQYg3rDOU3pCd09z6t7juMKARRL0MqxxQpdAbyr5vfvf44liAXDiUpYZFVxgafcM6BIPNEieK62YjyeMjfSlY5dX7ahi8aHaaoCm5PaGULDC2RUmpPRBfVEr4z1dEWehN0en1mtDxzyCOnc2P8qpPlpbproMHhfMn-NnDFB8xnNkt_ojHw-Dr9Wcx5CWKgFT3OacK3Rprx3jD6k0RUrFMJSNALrrmJXuWvkLw8carcte_Fq0Jqh_s6Q8plb5fVykBn2R3S8zirMH-kY08U8WIm2xDMXchaaIZ_Yzwj9au7xwcwghSdb2K5JlwqVSC0EJdmm8sit1gSeXpUfVnU4y1JPVKgsqHWsUlU5SN7IDMP43gySnFIANOlO1N-pCMYReDc_r7SioCBpmDW2wAiE4U5hv8ZKfP-v3hJPOPOJqYBm5ZashKMo38wbwiPDzq40bLd1MaHVt5ZH_rUax5Y5oUxiygfkxmLkdgqRgRJIPKMbs7iLjudPe5jVXkQ_FYY7nmoZB7BHkuZgJDSqZB5M_vZbXE9_qgfpKupmjyELHWGeXXOPZKp2UyQ8sSfvJpi4v3aMfn0ABCjx0ICp9WbhCkgTLSOuxTpTatANTGTzRu7YkPJRgDgZ00ixeTpkNZD4Q5fno1McfDAsJY_P-Sl40tXbDGjqk1sQGZRUy7vnozE-HBjlsdtl82XRuSiicpuoavMFgp9Uc9MW0EaLYX9QnvrnN4qvqpDI55305TVqhoezzWLdcWsdUsKYYn21XfBMv1-Sz9dQ20K9SrkSSR4t1tLgdk0zAqrH2CGvOb0wuuz-x9tRfr0MIOuHfzEyXwfE2QNsbePl9ShANnKj_LV0-r-lZ3qAbWMyALCk9Is0hpR6fdmd0qxO3HKfWYFICnh6ymiuPPvN7kK68iNK-bT8EoHPcdvRc8176yDjBrdjLb5O1kI1vKGxCaZCyhchXk17s_rJg9nm-2dGe9u_rTvj4ZkYPC_Fcse0L6YbUyD1-6W8vT7piBWP7h4P8vlHDiCBMCEkqdJ40M0JqRjU9NjhsM7FZwlTxJeCISsPs6L4gjR4M6RPRFVifgOBBSP5cjunLzhqcCQ5EH29gBqi2iSEeAPNKAJkJwLP4dAEQhfqNAEPpPHsFyY_2Y9jXRMOXbGda6cKoQXcAvW-tVw1-SuktzPiu361LPGtnVd3fcyjUGRnA4Gv4YoQvcJSxVm1EPpm38dvwPgfEZvNN86OWXpp0OnsUq8nyjxzy_SIxgM6JCPobtgUmoF1usmn88WkhGDOw3yQ_GwFL-4leVSC180MmIc91PBxHwSZNRkLUQdxWv-Xb_J924-iBtkVXtwwjG3um7bbhwC9CZJjA-wD-fTCJxsyZ60tqEa2hd2EDWN8pGIdrBPgHwVxFSuOUzxnBvCbkj0DNnqToj9BNYe4__ddBnIxFc_N3V0Fb5V8lTzJGSLD1JlZ9uB_H9YRT9r0e7L4hfv-ukI41MGRqjB0kulByGvB362E1AAbC338UFOxwbZwiutkG984ypFbZTHlaLFmyZjhpFlxZbfg2waf0pjJtEXlzoYc4PIbLbXdI7Kdw0qVQzkiulJkvTp81BhH-8LwdRhZalvMhvyY1HZl9y3xQWClV5qThnI2qO83fFSRLjBKmIhX5w0f5YXKiwjezWMDuiW_UBOHTvzS2i5p8rxIMQfA4EQQOG5FVpqTg6s9ONfVpG9-8AxAueAjnsDwNADtkeXY2bn4HND7Fj_6519CnskhlGTxC94_REgUoarT09D1FYDBJZfcDvItt2RwGCrhhYWzRb7e46I-Gg8xsbXw3fQHsXO3LlROG3I19KjOjtoFJNgTDhxob8anqAv9Bd3gXug8k7mT2iPWHKst_Rg8l2LRYpr9bncpaPQYuwfi8Snx2Qiv0HSpYtYJPRAULtLEt328kESXBGDybAoxC3hC06sk_mMcWkqdtTab7WwxjeBHzDCiWaBSTt5hW9VIvvpOuMuxSgdl-KVD9p9w3Dy3oNdolQ1c4nqbaOsZZDinhRENM5l8-zXfYF3BU12TWp2s260joFL3G0RyBDJp7MYaBaXJSG0CG9zXeVyjnRaiR-4Y_3UI_pI0GZmim6c9SVZoJaYPl_isfMnsWpYooL3VapuVFKS3d6HwG42IaGL5ZaNMqS0Ipz2Fq-YqYj4A93WRj36fr7pfYzQ70Xep1nieNz2buuh93DVa0R7ui6vsxO4qrDe-YDd4oPutwWadHLnXEieNyAshwvvD5LhhFqxX0UKRViLfIYHnC2SqmyTn2in-kmFVVUJB2KiBtYgmYof2HO-iwiExxJeURAHlQ4cN2UX44Am_SRXL-0k9MKoVexdR-EB763Y8FQMNWDRe0uWpMPbIsfc9o8A17GAKhrGUBK83Tra5JLWXlGAElAhiMIH0JhabFh1QHZySKtjQbtwGwEhdGMTeItjsI6_5H6Ya5IilQyunqwtHUOiIjmkuclK0EPtDe-0qZQKkwJOw8Qnk0rhZ4JLai_o3y182mIc80_bUCQcaAeQ7jgaaoBFSG0-FE3OmY6b5jRpdaVsIweISJBXasaVJ_VzzAGG-fgG1YU6LNCtuv7FvpVHmY3tqBQCGvSvhz8ijpLS91Y6wp16evUjXxMtQlY7eX2SjEnodlSdroC863y-ZhjTe-U8JjagUKMDzKwwbH&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=1578542443098544600&adk=2988274607&idt=306&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

750d70bfb8a9982b827656699387de0b63da65b2e9a247768005d9775bad42b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10878
x-xss-protection: 0
server: cafe
etag: 6410051166583139006
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:07:47 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/ Frame 822F 11 KB
4 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:07:47 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 822F 0
0 301ms
80ms Fetch
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuS-AmFCAAvEbMvKMi4eiTZ5LOMkBS72B1t0FzZSxFWdByILWk-y_YPrXtMLb-Kx-KK8_K5QV6E7BPZLvp8oZn6HeGXPLzMm4Cnqwgy_ucX8DZjT7ms75QmWE9TfVXEsHthBSqGbdB5NfGxUpvUlk9NS9U-eEmtGOcRb4qXl6CLhOOqMC6ZQ3oShH6F8MGnJItWjRd3SiGZjNcuR0I2BbN5Z_2L3ZiHnHTXESz3gMmyJA8WC7CGDIrq-JnpXRxdLEeSilBy0EZflMAkMEyqAsw9WE201Ok54-mFHi6CHmAbc-1iY1jwDcGF7Ylu68Gq4UuODrHEcWyxr-01PCHp7w6tJq2PV6iyhJHiCdV9F93j3W4Bjldy4MD9AvG5e3brOF-pHm9bimC0I8KQleVCtQZxrOetjILu8OCqQu00gbLJ-99u58dXgkiH4LmAW-OS0kA9Ggpw7S7sGqO3qIPEzwX-icWNNKOnmX2PZhgGuh_AV59TPXSmxiurjAhdozBG-fooDgk0QUhW5swjx73dhJn9j1F0L-5QKgUQspLg8jlvL_c4y_NrUtmqxvAuMYPa_D6cER3OdidLWFzi3pKinJMznjvROuOhZG6a2kgE7qeGhtYuGJIe3S8_3mdbeibbEUrAp8Fjmc2RXAcuv2h6x9hcbFepwFIns_ihMNgiu35qanKvytEN1_kr2GVTRQy9Zzr0Q746TRcDCmEhvCntJSGTSo2LeJcWyQra0OHoypWDe8GlTsS6cuFxaheN54AewY0pcn4k5KWXnzRNHfJVs_0JuoL7RlIv9irmYHh_HzWW2b7Ilbp_KeyiE2ej9IQbMwmrZT4KQ1QTBsYJ6jGFZXbzdAqLfMT5LeAE4J7dsaGOhHnvDwgtFoNNroKnjLhXJnudm8UoRYGzXl4snPTv8C8l8wLRIFq--5EjL1QGCP0AzqmcCWifCfpkel3y3VptFohhov2jlfVcf_X_GPtzn9y8erX1DlDXMaS0IJch-Ugy1XxN-XYGOIKaZlH2OrcuXb6_ViBcszaCWi_IrwXypcTQ6GjmQ88Z4oiOzwnzGBEUMkvYRW1Qq0l845c9PgBkXyE9K15wBNNDucuAd3io3xNKHOe61rYEl0CkP4DV1RF22cciRtcz6JeooLecTzWzFodjfuWPLVaZC4n6GXoxaz92iR8UJdBJcQ9uM-nbZ0eTWFJDJzd-IQfpoHtcJXlBhLM6mwUnmwtB2tW_F_DPoIKpKVuBLzouFT-RYy5mM73zTaVH-ROFWquSpyNCNGvOSZjINOrhj_psuZzR&sai=AMfl-YShU7H2yOI-i2Lbd-1tJVywUufyte2xsLSsir3BPJdO8i_PrSUw07FRAVfmE_R2Zaf7VRloFVEVPE2K2LjQmq_fwQJnjzMWsicvER-_CqARWl95LXyS1KQikWLfSMo7b5bBPe2xgY9S2q-0QrFjbLa72cQeevNq51r2hat_QHOe_OaSZTu-8fbFzWD_59jbpUZuFd6GOdNBmNYi2vvA7Mp51TaVFmW7tHTyllqlaYtbgWa3ZydGRQWVlDlCiIxhyz1ZmXu5KFEs91QzdA-W97G31iKqmNM4&sig=Cg0ArKJSzNetjPhtnoskEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=4&cbvp=1&cstd=0&cisv=r20230426.84744&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:25 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 822F 41 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 26 Apr 2023 14:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 346841
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Apr 2024 14:54:43 GMT

GET
H3 200 3311704122601845403
s0.2mdn.net/simgad/ Frame 822F 19 KB
19 KB 47ms
46ms Image
image/png 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3311704122601845403

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dc9a623e55aedb7563d96a2bd367237c17bc7d9493bae1300cae0e4e3af8af52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 06:06:20 GMT
x-content-type-options: nosniff
age: 205744
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19533
x-xss-protection: 0
last-modified: Sun, 11 Dec 2022 07:06:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 27 Apr 2024 06:06:20 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8DF2 640 B
265 B 88ms
76ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXUw2X1UlVUXa4ZBCXo1OsbWZj7ODO6QUay7wkkzxflTwGTa3IfrLcd7HLYzfeobGpAV6ZKuTQwN-4ZkrdoVD3N2GrmORpi1yan3CbbrK5dNHesCW6ZcR73PnYb57tOtZ1xu0JoKQaRySNXX399FzrBTQ94ydnOt9OKSzPt-TO1p5-SEdTPQcEMRdy-5cxHi1jnZ3TuusJiJ-lv88HDe8qdtfBREA

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:25 GMT
expires: Sun, 30 Apr 2023 15:15:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8B82 78 KB
27 KB 150ms
150ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B82 42 B
63 B 157ms
155ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AJ2evvBEB2vrzsKcfxc10EoSz11F_QhomfWz9qs_aTDl__j3-0ozgmMFYwpr_lmpqDgdyc3chdrlHujbjYFde_OM9igLd9mLr57B_5XW744-1cBKo

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B82 0
20 B 151ms
148ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5815852324295181779&x=1&ct=76

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 8B82 3 KB
1 KB 40ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 19:20:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 8B82 19 KB
8 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7966
x-xss-protection: 0
server: cafe
etag: 10783182253924109600
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:01:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8B82 158 KB
48 KB 53ms
51ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49538
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682508732222081"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/misc/ Frame 960E 43 B
528 B 76ms
76ms Image
image/gif 88.221.168.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/misc/img?mop_seq=0:1&mt_cb=390030&mop_top=
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=3069644e-860c-4b00-9b14-7db1a0fa86b9&no_iframe=1&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370&mt_exid=10082&source=mathtag
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.207 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-207.deploy.static.akamaitechnologies.com
Software: MT3 830 785530e master cdg-pixel-x32 config_version:"unknown" /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pixel.mathtag.com/sync/iframe?mt_uuid=3069644e-860c-4b00-9b14-7db1a0fa86b9&no_iframe=1&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370&mt_exid=10082&source=mathtag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:25 GMT
Server: MT3 830 785530e master cdg-pixel-x32 config_version:"unknown"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43
Expires: Sun, 30 Apr 2023 15:15:23 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C516 640 B
265 B 88ms
76ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJDi1MQCENjdsOICGM6PneYBMAE&v=APEucNXM8cUhMtSDsRWv_NxOqssVQCR7El012B5ESMDqpBaiPgsKJ5MFP_gazJ_mVa3zKqqXrE_KWphuaFDPcpmZgY3656FllIKA5HL3HOsGRBYoUu0ygYxSXXcr6U5SUXjsuXgXzAnruutUVXAuUY7Z8G2qoDoD_ahtj85eHj5egMnssZeitWsdZ9b7wvSo75LMXSjRgoE7dA6GbAGlgyfLXER4HLo8qg

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:25 GMT
expires: Sun, 30 Apr 2023 15:15:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 5A85 78 KB
27 KB 156ms
156ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:25 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28043
x-xss-protection: 0
server: cafe
etag: 15270303690107644053
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:25 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A85 42 B
63 B 139ms
138ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CFQVcBq-6Wn6742aRjz0mf2CVzWheikHUa-zmDlSWjoBe0ExlaMnCb5lLGyFE6TiunTmFnjheyglM-uZlErNaWBMxXqtM2B2sK-Ie6QL-0jyeZNoo

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A85 0
20 B 140ms
139ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=9262389176477379403&x=1&ct=77

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 5A85 2 KB
1 KB 104ms
7ms Script
application/javascript 2a02:26f0:480:9::210:ee05
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=15911784&cmp=203336&plc=7322076&sid=18330&dvregion=0&unit=970x250
Requested by: Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee05 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: e189eb8fb761166a6d657a8dbea2c5d73e224e565716f36406ec7f7b68cd78c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Jan 2023 10:59:51 GMT
Server: Microsoft-IIS/10.0
ETag: "2d4a10aae224d91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1170

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 5A85 3 KB
1 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 19:20:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71680
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 19:20:44 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/ Frame 5A85 19 KB
8 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230426/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 02:01:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47655
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7966
x-xss-protection: 0
server: cafe
etag: 10783182253924109600
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 14 May 2023 02:01:09 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5A85 158 KB
48 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49538
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1682508732222081"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/ Frame 5627 28 KB
11 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DwL9G7kX7spY1Z4TT9lv_7qhwNJ6g69n4x2LvcrQ8HsocjaM410XYaI5Uig8R6Ukvanv8-zqPKBAkhTssZbodf3HqfgQ&cry=1&dbm_d=AKAmf-DbsfzbFneTX2bl6GN2HESwXwmHvGvds3SUTiEnl1i9i0Zvi7WLhJsUypbX3CHfoXQCY0oNVOHwLhihtJabIVbPRdkJRIo00B7W76459FW7st3r_bbVUlP2l_CXclJ8Ic3tNVGxI0qLiFzL-Wo4O_MK8Ysi6dmvWfR1vTvAT4ByAwUmpsWPoKnvJHHClFJFEbfnLj5qACFYcoS8-dVa3mdLGrP6-Eyb4bF0raegyZb0DC9WoGusdgJHgVbwPPRDshqEb3aqDcsTabcq_R9DPo9CstdPKpUAmsTATuZdWpvNnYtFjRF7mUjPPDuvClJwYdbF3v_R68WAmHQo0WcbGNTGega3oJ0Rdaq5JkqU-YU4aN3DIWKD-AiuHgmrrmO145H8BcMcCH7LxUiyQB3Tyov3OHZaoB4T2wiAvgmITid1T9OoToSttY4kdBMCDfbSqI6iPS5EsiDSicDPbA4hZ7bxu7te7bvg_FnjEG9F-LrvLg9mGDcmlBqSgGaF6aMRP5725VflUhcuIqvNrzROunM2nEU2JrpU3roGzY8AkPx4FlC8RhV3c-wLN28wyvJTGbMeP0T4FvQuVgCBFkAXZUwLBl1AqAA3qxUAIk3bVKGZRn_qnbsLnfc2wfH54yN4B5Y1iC50Ly08ms66v-yAXhsQ4hInmB3enGNJRSHeBAuaw8tZ-loSIPgpGQjQ5MyzWOJQntk3HHJxJYDpEkC9lm1gp1natqF9aMQVOHfj5b4NJsQk6r1D9RsOShzEF708jbC9curBBeNuJdAaBXGSeMqXT1ClnWKqIbgcueMcyzSE_JI8N3kFXIaeaW8MP2iYPtGf9s-bsCDBQFM-1_3J57FaQD41lFrNk55h9RdLVDKTxQkYwYh3hjU2uJuGbjkYby-ine0AUyMf2g9hAdws4_yCv_LWagEDahhFMfpONkK8jOXI4Iwu8OfeaFt8z-8zObF_w0Obhq7YPq7Mxb6-V5X3uR53rkSW4LvwmNzwCSdB-XKb0tZaZMtWKLInvegg_RipiQDk2NojjHWi-Y2SH9O5EbF6LEGRTf47dIrh50dkZpmu99vQYGswLXw5WagAEp5kXeB8yBYAWrbNh1czBR6qunYMjevRq3Wh60UKbU3PPe-gNWcvrurHF9O-WDhN4AHAf5VBn75mBhS3xVLzySUTZ9I-VRRWjnVF7-gC2sRuZAF8ANCwc2fPx9qvc-opItukqonzENA8W-_UaEwzj_XgmtrTRk8s0bBDngoCuTPOMfefFEli8e0iToDJzH2YldbH4RsBrgKZtqLy4Y4WOp-BI-MIgHOgLzb3KHSGL11MDSf9Cg_jfu7ly5dPImeX8mMRkLfkhbU3JsXh_tNxlbqCM1aelKhLPCgEzzhqh2iBr8R6e6Mdjemm7z1kj3Pk0qTR7QgBI-1P1WYeiXY8QukrJzBceBtfZQ3Gt0wEDqx63gRrfB9sOsLL5j5-rONMjwm1IPhs6zbwdU7o4JvrTWEmvCS6ihA-7GKKDKbWkNuPMNRPD4SyF3V-AE37I1qQx_FJmAmKpr3VB40AFE5c0w4Cn6SGgLJUpp3-AzHy9kkzShuUsRQ1yaaPzgLdIEsT1C2TNuFwxV0iwWJEhjD_Erlg6EdWIDA7sNLmjjl_RKEAM6TpoUv4Inc0xwlz3QWcA8MLjwq4uQRGbF6VDnPi7wUa68omIvu10--uiBFRzerAe5Z2Mol5gEu0ORNRL2zI7RS5qLnqh_R-TsZe2RZZwLTijr9onTdyDRq4YyolX7FE_01wRbm0e8Od-lL_t3f3FRFGAJEeivE04zxgnM4nKw3ysaQubNe1lIt3zojQWCLbOpFLb1eIX5KWW9-0ppfhW1FkXiVJlQCrTI5C-jHYfPJWPYSMXVR9S0O65XfqeftKCx0D17mNhRsloo9THULidHBrLz35XcIpPmztbCw7uYIiiqmTcfX732-4H7ndzwzYe1zqLt-9plsMUzQZ05lPvc2ZFOjxX1RyJpx9g6qi_iaX5ZBQrlW_W-R2A-9BS-C7G3eG-d1_5UxJdh-cji8i2Le6Kdr2x8mp0lwhMMsjY0T4bHkCdBE0IRk2JBDVWzR9qxoskFI3aTAcIWLITTBzYdaVJ4SZfQtzSXxu4_Kkb_9diDCiDP2mA4I75E6vMkzYPFsFUbXTSRTVgEv1UzmyPGS0Rc5EG3CmCLiXR6NvUgLJMD-D3iwoC3F2YHJlsJeMNkHWC2p3LaY0eJHPX3u8MRmH5S8pTWe1J1vF4bn-ga4FYEJyA1s5w3AOM84allIDdzQwfWL-4dLiU6lbLZaoqByQ3WTMk_uYIr0a_ANZ6ceF5CJnjF4zmadSTlEBny9ewrIRDOVfAC86OFzWtisAFCb6MKdC0C0_ayR2Oc3chgE3vjee3FgmXIx9tW3uvvc1P4YuCTxw8HToFj_nkD-jQ3o1tLLcDxHqYJEVxcDNei7OlwGKC_Lsww3DtWfxb-JggsI7aNlFirCa0-fHgaAGGMC5I-YVeRx5BOXM9CfqsiRLwl3jCW15K2w0XcFAjAVblOnBVw40qx38EQ12__xy3ALwjTCwmL9MnUcFgrFApTRjPUbzYAPltDSjEhoIs8jo4LznPhMg6hfah9jkHhOTnL4gBB045uCwKNKF_MaF-JIVHSHPr8eRU37xIa6bUQxS5t3lDIo3RnpuUn0Ubs0Gc9b-zFzM7zGQqDgU5K2wv1Peh5MuXJmRKejghg4a7Yi05PG3p-cJYL4g3bMcPm2cZErSYm8KCP7gRoTM-Ei4baKM2iHvMZ05yF8mx9qMnZYCNTpVNfBiDQT_HRIZKo6Z4tmLgx_enkU8QRtXBlG0Y7OYgp2EN3kxTDRo_VoDGqT9jdnLxPTdqSm-hXGlybKs8Nv4wIxu_ZJURY0HX1OcVkAJKq8g6S18KMaYTlpo1FrsfRlFbHWNSqshQJxfShCjqCjjMtrnOhnEnwxWEcgGHljkHTA4UhHHtYujJ1hc4ybRiHiT5kA3eG5BGTNckBlRcngshs9bqo5jZGnoJz-8_ZHOZMc14OFv-xObLGK8FTQA8MPu7ZlSUdxNcbhHGFItXiFCbL4_JpKz8GWnG1cagKewCSZRB5KCIYzUwIhk0o1vNQAic-IfhYVxDWi-jZDazsF5G1kvYSQGRZF06Mi7q5PioYct7BRWq0YDlj0kH50cX2AdIrKvZUD69R7Vt1jgJWe4_V1oQQFDu8tPVAH7aN3HHNSolhePU7BkRRCfA5McnMkH_h5Sycd7zZOHSrxhBAXOmLJEcvxnhMYa_EobXohVn4eR1XVaxn05vbCX7hPVB2xjLzaBU19hXUzpLWZcfabQmx32lHWONdm62piQcis3trxWgjGNVJu7o82Kl3iET-2nPAoHZ6Lg5IzbEcr3A_pB_yi5l4jo1ZEzAsbB1aWvo6inVJbtAzncg20sYbzuoN00wzaWcdimRLNIUrLautiuu6E164E7QTStznZNThybjvA4m9s9SxwwPvkvbB7hG1k0MbP809WMNFgEzG51_-imsWJ5WY0GGPs_uGEd00KumHVGlCdHcup_1w3KdxHt3_sTu1Vn-D0TBJUM5Oz8MEyzFxOu&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=18180370243886703000&adk=2086295851&idt=327&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

750d70bfb8a9982b827656699387de0b63da65b2e9a247768005d9775bad42b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10878
x-xss-protection: 0
server: cafe
etag: 6410051166583139006
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:07:47 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/ Frame 5627 11 KB
4 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68857
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:07:47 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5627 0
0 137ms
82ms Fetch
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwIQ58T99Jcw39sWzUpNbn0p40iJLi4n5NunK0YrVXsBi4s1dOt_aOWKsRvTCxs8kHYqD7LLx4J6N_cVGqCj1P6mKdmGAJvv0DO-mbX2OYfdZ37QZPXX-WDDtuGBvdSEYX_b68WZNz7Uo9Nl3qqxk9g34WE6mv3vXL1wrrq2KRqzThSnMWdB3i0aqamtJVdk7GWT5P9evzgCNIWgd6Xod2Lxwh_N3b-yuxjB1aBBbit-d5HV5glljdl_vVAG0DSaYZusJjmaTg5CIOZMijbNF8yrEelvJCJBVentx-62yd1fFabaoFKzl1I-IkOT47J89CdFdINt4Zawavw6Jk722yEIWMS9HmUT7Nk0cm-MFhu89IyniRDEfvXm_QotH1br7pDUvGZ4LKEwxKb6mc1S0F3tE6ZRcq8hCWimbnsYljZs2r1gw9jMaaRAKkvOFOc2lmn5XueGWKTkDWCuUhhW1UfTz9MhVjDkRTro5LKZ-bc49sVbWTp-g5h3Nwk6F4gqxKVTX072OCxp3_sGYSOv9lMnB08o1G9OjSwf7YsW8eXC1llUV2e8w-gZ3-JEJjM0uWlTh0nNrMeCpZOKnsCGILwa6PFsr6NVDefu2ywBH7RBbMnLUta_rOFYJShH7JzuhwAIQNASfiBPWHsCfU-_Amm7m8_fLvrUr7hxAEOMT2yCGP-GINAIESwQp8hGHSJqDaevUWthrHsAR_mzZAZMfiu5Z2_kGGV_paTjptP2A-mgje5kX53l1un4u2RZzrTza6BC8nhfHt9fzG9C60DORcU7W6GUC-s4a1L_ZLNCzWl3MxBh1p14ancS3KQedYQ-7Ladp-0kcruZOzhZFBEaLu_QXsRfimVw2S0EJWeBQ_2-xitqzDJSxPKCp4OlsebqEfPgnODSU1wV45rhEniJMfQhof2XZyJzahHG6OPTYXh2uXDwmLlr-4B0ljAdsQlSKVbz19E3Oy0I7cO7Eqs391zjSxd3eVfM691zqrrZ6zbQNDM5zcnHkZGmQmDufeqRkkkfeXAfodrCv9B0QRHYyjpx6p9RsR8MTvWfGnHQiS9pOE6hECIQeGp6CSFQOkdJIkeIFbzLAb_gev89qm76n5cvrnju55yywCBn0ZIfZNhiVArdYIT-p_Yvw_PsP-HJB978cE1jUDLgnPOn-ivNtfhPRZQ-PEiYc1eLpk-PQHhlpnPilOVkDb0g-vCelrgUqX6Pc27koIv6vrViTp5ybaVDke0k2xf_OFlayN9tw2liPhaspg9xdDx03sMrmfWeS2EGDAzSs&sai=AMfl-YRUuD4DY7uPRbz2Mda_iqt2PExjBiX_skJqXXzb0hcDcJWh_GOJzFlF-qye30210WxrWVwQwTxLgAIi-17oXKjUfupJo0EjM53R0YQVkGi1CBCoXidPOvxxZgB3_44bnuGuU1EamYsYu8JXU8S42kXZPHtwbPaBdWEsEdGSLoqqGlHu2ZhAGfGs5kHoX1ffV82aIIsikO1c8Rd7oYU-UWwG4wm08Kkf6LfcNR3IyFMCdgM8A96JbCU4wWD7REygx8KFEQdIF7EkKqPJe-VBZOLgRC7chuB9&sig=Cg0ArKJSzIBOWfAPosSPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230426.36903&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:25 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5627 41 KB
15 KB 48ms
47ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 26 Apr 2023 14:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 346841
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Apr 2024 14:54:43 GMT

GET
H3 200 2634784035555029359
s0.2mdn.net/simgad/ Frame 5627 29 KB
29 KB 51ms
51ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2634784035555029359

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01b3762a10e39557f9c201e926232b387813b1ec2f7ecae96fecc06c656059cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Mon, 24 Apr 2023 07:15:53 GMT
x-content-type-options: nosniff
age: 547171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29326
x-xss-protection: 0
last-modified: Thu, 20 Apr 2023 06:21:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 23 Apr 2024 07:15:53 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 822F 0
0 73ms
72ms Fetch
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuS-AmFCAAvEbMvKMi4eiTZ5LOMkBS72B1t0FzZSxFWdByILWk-y_YPrXtMLb-Kx-KK8_K5QV6E7BPZLvp8oZn6HeGXPLzMm4Cnqwgy_ucX8DZjT7ms75QmWE9TfVXEsHthBSqGbdB5NfGxUpvUlk9NS9U-eEmtGOcRb4qXl6CLhOOqMC6ZQ3oShH6F8MGnJItWjRd3SiGZjNcuR0I2BbN5Z_2L3ZiHnHTXESz3gMmyJA8WC7CGDIrq-JnpXRxdLEeSilBy0EZflMAkMEyqAsw9WE201Ok54-mFHi6CHmAbc-1iY1jwDcGF7Ylu68Gq4UuODrHEcWyxr-01PCHp7w6tJq2PV6iyhJHiCdV9F93j3W4Bjldy4MD9AvG5e3brOF-pHm9bimC0I8KQleVCtQZxrOetjILu8OCqQu00gbLJ-99u58dXgkiH4LmAW-OS0kA9Ggpw7S7sGqO3qIPEzwX-icWNNKOnmX2PZhgGuh_AV59TPXSmxiurjAhdozBG-fooDgk0QUhW5swjx73dhJn9j1F0L-5QKgUQspLg8jlvL_c4y_NrUtmqxvAuMYPa_D6cER3OdidLWFzi3pKinJMznjvROuOhZG6a2kgE7qeGhtYuGJIe3S8_3mdbeibbEUrAp8Fjmc2RXAcuv2h6x9hcbFepwFIns_ihMNgiu35qanKvytEN1_kr2GVTRQy9Zzr0Q746TRcDCmEhvCntJSGTSo2LeJcWyQra0OHoypWDe8GlTsS6cuFxaheN54AewY0pcn4k5KWXnzRNHfJVs_0JuoL7RlIv9irmYHh_HzWW2b7Ilbp_KeyiE2ej9IQbMwmrZT4KQ1QTBsYJ6jGFZXbzdAqLfMT5LeAE4J7dsaGOhHnvDwgtFoNNroKnjLhXJnudm8UoRYGzXl4snPTv8C8l8wLRIFq--5EjL1QGCP0AzqmcCWifCfpkel3y3VptFohhov2jlfVcf_X_GPtzn9y8erX1DlDXMaS0IJch-Ugy1XxN-XYGOIKaZlH2OrcuXb6_ViBcszaCWi_IrwXypcTQ6GjmQ88Z4oiOzwnzGBEUMkvYRW1Qq0l845c9PgBkXyE9K15wBNNDucuAd3io3xNKHOe61rYEl0CkP4DV1RF22cciRtcz6JeooLecTzWzFodjfuWPLVaZC4n6GXoxaz92iR8UJdBJcQ9uM-nbZ0eTWFJDJzd-IQfpoHtcJXlBhLM6mwUnmwtB2tW_F_DPoIKpKVuBLzouFT-RYy5mM73zTaVH-ROFWquSpyNCNGvOSZjINOrhj_psuZzR&sai=AMfl-YShU7H2yOI-i2Lbd-1tJVywUufyte2xsLSsir3BPJdO8i_PrSUw07FRAVfmE_R2Zaf7VRloFVEVPE2K2LjQmq_fwQJnjzMWsicvER-_CqARWl95LXyS1KQikWLfSMo7b5bBPe2xgY9S2q-0QrFjbLa72cQeevNq51r2hat_QHOe_OaSZTu-8fbFzWD_59jbpUZuFd6GOdNBmNYi2vvA7Mp51TaVFmW7tHTyllqlaYtbgWa3ZydGRQWVlDlCiIxhyz1ZmXu5KFEs91QzdA-W97G31iKqmNM4&sig=Cg0ArKJSzNetjPhtnoskEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=272&vt=11&dtpt=268&dett=2&cstd=0&cisv=r20230426.84744&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 30 Apr 2023 15:15:25 GMT

GET
DATA 200
OK truncated
/ Frame 822F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: feb87ff6c8928a530994bd7ca34d4b0c9e9a0dae89eb82767e587955c16767b5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK img
pixel.mathtag.com/comp/ Frame 960E 0
492 B 17ms
17ms Image
image/gif 88.221.168.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by: Host: pixel.mathtag.com
URL: https://pixel.mathtag.com/sync/iframe?mt_uuid=3069644e-860c-4b00-9b14-7db1a0fa86b9&no_iframe=1&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370&mt_exid=10082&source=mathtag
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.207 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-207.deploy.static.akamaitechnologies.com
Software: MT3 830 785530e master zrh-pixel-x15 config_version:"unknown" /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pixel.mathtag.com/sync/iframe?mt_uuid=3069644e-860c-4b00-9b14-7db1a0fa86b9&no_iframe=1&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370&mt_exid=10082&source=mathtag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:25 GMT
Server: MT3 830 785530e master zrh-pixel-x15 config_version:"unknown"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Expires: Sun, 30 Apr 2023 15:15:24 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 89 KB
29 KB 66ms
32ms XHR
text/javascript 2a02:2638:d::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.135.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:25 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Mon, 01 May 2023 15:15:25 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 2388 15 KB
6 KB 20ms
20ms Document
text/html 2a02:2638:d::d
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=earnme.club

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.135.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

97cf4206e208ceee4baa88c1d02f47176d84c5c84f85f63bca9d23aa9f077dc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://earnme.club/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:24 GMT
server: Kestrel
server-processing-duration-in-ticks: 1289324
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 / Show response
track.adform.net/mobile/script/ Frame 1BBA 6 KB
5 KB 27ms
27ms Script
text/javascript 37.157.5.132
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=

Requested by

Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.132 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

06dfd43c4b060f93511c3616a9224c236169a690f319e9d982085210e2122189

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 4159
expires: -1

GET
DATA 200
OK truncated
/ Frame 505F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 75f7af1fe244190576acd02b03bf98c68ebd75ebb221001ded5a2a55c5322827

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 8DF2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1

43 B
114 B

27ms
26ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXUw2X1UlVUXa4ZBCXo1OsbWZj7ODO6QUay7wkkzxflTwGTa3IfrLcd7HLYzfeobGpAV6ZKuTQwN-4ZkrdoVD3N2GrmORpi1yan3CbbrK5dNHesCW6ZcR73PnYb57tOtZ1xu0JoKQaRySNXX399FzrBTQ94ydnOt9OKSzPt-TO1p5-SEdTPQcEMRdy-5cxHi1jnZ3TuusJiJ-lv88HDe8qdtfBREA
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 8DF2 43 B
131 B 46ms
21ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXUw2X1UlVUXa4ZBCXo1OsbWZj7ODO6QUay7wkkzxflTwGTa3IfrLcd7HLYzfeobGpAV6ZKuTQwN-4ZkrdoVD3N2GrmORpi1yan3CbbrK5dNHesCW6ZcR73PnYb57tOtZ1xu0JoKQaRySNXX399FzrBTQ94ydnOt9OKSzPt-TO1p5-SEdTPQcEMRdy-5cxHi1jnZ3TuusJiJ-lv88HDe8qdtfBREA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 8DF2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1

23 B
172 B

47ms
47ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXUw2X1UlVUXa4ZBCXo1OsbWZj7ODO6QUay7wkkzxflTwGTa3IfrLcd7HLYzfeobGpAV6ZKuTQwN-4ZkrdoVD3N2GrmORpi1yan3CbbrK5dNHesCW6ZcR73PnYb57tOtZ1xu0JoKQaRySNXX399FzrBTQ94ydnOt9OKSzPt-TO1p5-SEdTPQcEMRdy-5cxHi1jnZ3TuusJiJ-lv88HDe8qdtfBREA
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

expires: Sun, 30 Apr 2023 15:15:25 GMT
pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 8DF2 23 B
172 B 66ms
31ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMD3swEQ3cu5ARjS75DkATAB&v=APEucNXUw2X1UlVUXa4ZBCXo1OsbWZj7ODO6QUay7wkkzxflTwGTa3IfrLcd7HLYzfeobGpAV6ZKuTQwN-4ZkrdoVD3N2GrmORpi1yan3CbbrK5dNHesCW6ZcR73PnYb57tOtZ1xu0JoKQaRySNXX399FzrBTQ94ydnOt9OKSzPt-TO1p5-SEdTPQcEMRdy-5cxHi1jnZ3TuusJiJ-lv88HDe8qdtfBREA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

expires: Sun, 30 Apr 2023 15:15:25 GMT
pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame C516
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1

43 B
106 B

28ms
28ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJDi1MQCENjdsOICGM6PneYBMAE&v=APEucNXM8cUhMtSDsRWv_NxOqssVQCR7El012B5ESMDqpBaiPgsKJ5MFP_gazJ_mVa3zKqqXrE_KWphuaFDPcpmZgY3656FllIKA5HL3HOsGRBYoUu0ygYxSXXcr6U5SUXjsuXgXzAnruutUVXAuUY7Z8G2qoDoD_ahtj85eHj5egMnssZeitWsdZ9b7wvSo75LMXSjRgoE7dA6GbAGlgyfLXER4HLo8qg
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEAB21-EKldMBpWwslPBOvj0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame C516 43 B
120 B 43ms
27ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJDi1MQCENjdsOICGM6PneYBMAE&v=APEucNXM8cUhMtSDsRWv_NxOqssVQCR7El012B5ESMDqpBaiPgsKJ5MFP_gazJ_mVa3zKqqXrE_KWphuaFDPcpmZgY3656FllIKA5HL3HOsGRBYoUu0ygYxSXXcr6U5SUXjsuXgXzAnruutUVXAuUY7Z8G2qoDoD_ahtj85eHj5egMnssZeitWsdZ9b7wvSo75LMXSjRgoE7dA6GbAGlgyfLXER4HLo8qg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame C516
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1

23 B
172 B

38ms
37ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJDi1MQCENjdsOICGM6PneYBMAE&v=APEucNXM8cUhMtSDsRWv_NxOqssVQCR7El012B5ESMDqpBaiPgsKJ5MFP_gazJ_mVa3zKqqXrE_KWphuaFDPcpmZgY3656FllIKA5HL3HOsGRBYoUu0ygYxSXXcr6U5SUXjsuXgXzAnruutUVXAuUY7Z8G2qoDoD_ahtj85eHj5egMnssZeitWsdZ9b7wvSo75LMXSjRgoE7dA6GbAGlgyfLXER4HLo8qg
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

expires: Sun, 30 Apr 2023 15:15:25 GMT
pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEESntYwdDwDb33UyTKk6LJs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame C516 23 B
172 B 55ms
33ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJDi1MQCENjdsOICGM6PneYBMAE&v=APEucNXM8cUhMtSDsRWv_NxOqssVQCR7El012B5ESMDqpBaiPgsKJ5MFP_gazJ_mVa3zKqqXrE_KWphuaFDPcpmZgY3656FllIKA5HL3HOsGRBYoUu0ygYxSXXcr6U5SUXjsuXgXzAnruutUVXAuUY7Z8G2qoDoD_ahtj85eHj5egMnssZeitWsdZ9b7wvSo75LMXSjRgoE7dA6GbAGlgyfLXER4HLo8qg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

expires: Sun, 30 Apr 2023 15:15:25 GMT
pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 8591
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

56ms
54ms

Document
text/html

2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:25 GMT
expires: Sun, 30 Apr 2023 15:15:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 15:15:25 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E108 22 KB
8 KB 39ms
38ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 9820
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 12:31:45 GMT
expires: Mon, 29 Apr 2024 12:31:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 5627 0
0 75ms
74ms Fetch
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuwIQ58T99Jcw39sWzUpNbn0p40iJLi4n5NunK0YrVXsBi4s1dOt_aOWKsRvTCxs8kHYqD7LLx4J6N_cVGqCj1P6mKdmGAJvv0DO-mbX2OYfdZ37QZPXX-WDDtuGBvdSEYX_b68WZNz7Uo9Nl3qqxk9g34WE6mv3vXL1wrrq2KRqzThSnMWdB3i0aqamtJVdk7GWT5P9evzgCNIWgd6Xod2Lxwh_N3b-yuxjB1aBBbit-d5HV5glljdl_vVAG0DSaYZusJjmaTg5CIOZMijbNF8yrEelvJCJBVentx-62yd1fFabaoFKzl1I-IkOT47J89CdFdINt4Zawavw6Jk722yEIWMS9HmUT7Nk0cm-MFhu89IyniRDEfvXm_QotH1br7pDUvGZ4LKEwxKb6mc1S0F3tE6ZRcq8hCWimbnsYljZs2r1gw9jMaaRAKkvOFOc2lmn5XueGWKTkDWCuUhhW1UfTz9MhVjDkRTro5LKZ-bc49sVbWTp-g5h3Nwk6F4gqxKVTX072OCxp3_sGYSOv9lMnB08o1G9OjSwf7YsW8eXC1llUV2e8w-gZ3-JEJjM0uWlTh0nNrMeCpZOKnsCGILwa6PFsr6NVDefu2ywBH7RBbMnLUta_rOFYJShH7JzuhwAIQNASfiBPWHsCfU-_Amm7m8_fLvrUr7hxAEOMT2yCGP-GINAIESwQp8hGHSJqDaevUWthrHsAR_mzZAZMfiu5Z2_kGGV_paTjptP2A-mgje5kX53l1un4u2RZzrTza6BC8nhfHt9fzG9C60DORcU7W6GUC-s4a1L_ZLNCzWl3MxBh1p14ancS3KQedYQ-7Ladp-0kcruZOzhZFBEaLu_QXsRfimVw2S0EJWeBQ_2-xitqzDJSxPKCp4OlsebqEfPgnODSU1wV45rhEniJMfQhof2XZyJzahHG6OPTYXh2uXDwmLlr-4B0ljAdsQlSKVbz19E3Oy0I7cO7Eqs391zjSxd3eVfM691zqrrZ6zbQNDM5zcnHkZGmQmDufeqRkkkfeXAfodrCv9B0QRHYyjpx6p9RsR8MTvWfGnHQiS9pOE6hECIQeGp6CSFQOkdJIkeIFbzLAb_gev89qm76n5cvrnju55yywCBn0ZIfZNhiVArdYIT-p_Yvw_PsP-HJB978cE1jUDLgnPOn-ivNtfhPRZQ-PEiYc1eLpk-PQHhlpnPilOVkDb0g-vCelrgUqX6Pc27koIv6vrViTp5ybaVDke0k2xf_OFlayN9tw2liPhaspg9xdDx03sMrmfWeS2EGDAzSs&sai=AMfl-YRUuD4DY7uPRbz2Mda_iqt2PExjBiX_skJqXXzb0hcDcJWh_GOJzFlF-qye30210WxrWVwQwTxLgAIi-17oXKjUfupJo0EjM53R0YQVkGi1CBCoXidPOvxxZgB3_44bnuGuU1EamYsYu8JXU8S42kXZPHtwbPaBdWEsEdGSLoqqGlHu2ZhAGfGs5kHoX1ffV82aIIsikO1c8Rd7oYU-UWwG4wm08Kkf6LfcNR3IyFMCdgM8A96JbCU4wWD7REygx8KFEQdIF7EkKqPJe-VBZOLgRC7chuB9&sig=Cg0ArKJSzIBOWfAPosSPEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=275&vt=11&dtpt=273&dett=2&cstd=0&cisv=r20230426.36903&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 30 Apr 2023 15:15:25 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B82 0
20 B 136ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2864990614516&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B82 0
20 B 137ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2864990614516&version=m202301230201&ct=76&x=1&cor=5815852324295181000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8B82 70 KB
33 KB 73ms
73ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CHTFTHEhD_BL1ILcUUexRpjbkquY3cZdCUQqefkjZjGvnCWR7ldmA6gF68HxUYm71-iKRiS7NbAHGQBYJxcyYfEpC6Uw&cry=1&dbm_d=AKAmf-AfOD9hTq6rrMn7wGxfh9mqonKmyWZBff90MEi--fz-MxX7BGGBBrc3CK45Ta3e6KZAcSD9T4CRprSViA4RQpfLyMGnZcss5FCwKBTJ4CB8XqT3JL6n0bIrX7CV7z7UP_zC02cUSkrxkQ8A3YumHevfhklsYuanjmt-vGAbh1bL4JK0aCQz9biWYeb9qIBW0HHMtNtWWgML5QSPRY2C62z_d5pk7NhVVEBpIXstABcw6mEcGdn6l8lnwqNXfkGH9cJQRXnpfvFBWPmzuEXD4sMqxTAuEhS3IjGj85lLlX6sby9sARv2O0gkOpYfTDT9WGdSABvHIh1huFMb-rFbtmwUhfD0LTe3MVfhQGVR8PTkjNwE2xpyVC9qM5jt9j5Id3k_pvPPxJ-ZC-TaUkMepx5ipFDN75vWVQFpF-OQNbyuBTIqRdLo1c2D8lKpmcSwXOS_YeTMUq98WK8bekjJLHXtBkyw6KkTA2ZffFLmC7jiDcnKutQmjZX1fH6PUChvbkTsVbIEfbzlzKOkl8wNorFfOlGDnNRMuD9RU_aZDXcJxU_VkKlylrIca-lsCYg9SD6-2YBMwm2onD9SxIglHtNvSKjtYPO9g5Q8hBMcCpGkLgK_EgdXuxXBHhEBIcG2sJx5FRbpYR6ywXj8OJIiRN6RaR7pBFX-rVG_dks4juv39ImsCAyVYnyHdNyoa60B6a_2VEJDmQB9L7m0CXDP8takH_pzr9M17vTiVXAdlyRhzEuVV2YGsCxF44I4_ht2LE-ktUlBcWGymOFNItrlWPNPEpevv8gCetNAlqf9oIwREdrUVNKCA_jezn6mQHmt4xJtkcC26V_aOnRe6kCGxDLVwaN0xK2b_OaHqbye6fweXxuLRJT8NNKZ32nxdlX9WW8kRUukBXTdaIyuCL9J8GiBggfTpL4xb-qOVNng7KJiXF-KCKrBZy-2AeeRGhy3InPh4UtWVeTkBsqHFIENGrJn048RFCdBJgShVy62AYu7DObGFJX7736XH6gJIY1Rmo47ABtKyyfeCsBXubAVfGAVPdn72ZocwaZ2qX4_DjxuXKK8iJKiIUfCSwiq_pftcqbXBkvZr8S6pLmBnAHHlx6Zbgc4sB_6SGno50eg0Wsny0qtPV_iT0jUJiozlaYR5gwV-KlbqjDX4x9Qk4CYJfFSGUkq78zw4lqKvVtIByUadBlqB1-jbyAxlVIyRg_wLLrkCZsUOO-hbzAFvc_A2EhbakpRpqZBuICDSEOnCeomR4KUx3zXD4aA_b0OAoyufIQUO3KPEzJBelsU66or0-Snzv0d9msYwlJNk2ES31bifF_UprzpyOMrv_pTT_joc5E4A063In7m_K2c86kztkt6DnKYpVI0JyDpyHiqLw5J63ASfi70eFtIX8ReXOyTw3jhoTM29lcSwtldMeI8li-0SE6g8bKVxP19QJFC43EzsQ5riQoBUB8qYa_st-IAD5zwLsKBD_OZt5YWWaA3OO0p4GR3N7ah-XuQZb6sKOMW5OIW5pke14-Q_Klvqd-KLWzHrlK-X_MvPGnVT3rsBJwo0IqPhuF4bq96wJEog6-87w2Z1dcNdvdXuBxEwycemU4OVTsrMgihqxTo8eEuIGV1Fk4H91bQXYrrgZTL4EKJJxPGDaM4PiucL1R2OxsZHPzd8NfEmmDxfyPDpe9cTWbDtnXsUAg2nAVhr6bbXgo--YNjohDk52Xenc0vyhjGkODZZhEsfgB2lPiuvgKFhCd_Lr3O-Uxdq0Mk5q8WFnoUYpBVKFMQTYa3HxHefyAbDj3NHrZoTi-niQ1SHLHVPXW4HdkrHKJJVdzZvjFxgTQY_fRc9I7pzQRKqTPuHfLKLWppWTfq9lONKIwbpiT59WZCAOex-ZSx_ruL10fiGnxsbiFeBFBJPZ_GLSfNjHGQcAYmyh4CyL5wezvW5PYON0Yn1mE-8QuwTddYXzMplfS9NAyX623dHKL1-hvZRBAc26zRkf1DIcAf6dd28eRQ76pvh0RODXH60634WhoRDf4Krkvhx6vAJmniEgvyI4CA8jn67a7fJ1vstkhMhxRXEWKhsd0bAyGafKmactm285pJadt46wMiT6aeBlWO6giMr2VwQXijZjBUPrld8HAGQc6Qsbd88ndbYLjR0WJxgmTp6C0qEA4OJYyeJCGqYFwWFQJ-q3W4E80J7kyAkmFJoPHjKqr1m07tDk1348t1q3KGzrdnk-9LQEm0NdbomywTiKz2tB7q5FIeIoOnHlKY9nFcNUF30NAOrzw-ZyKV2fF2CVCz59nsv24-5THY8Bakd5omOudHA34CQDbyb5GRkrv3erJjUY8nkqaXleJjdDgd8ZO_vLsOyZd4pUBTqXstXCohwLOZY4ihFDF72nO0aUV1SJIhGeg3QYjStEooWpA_h-x9A6Efj-FI8nQXMw5Z0EHHtHy4ST3U9k69p2rCtot3FFzBURabqP9vbQ2CkklGFjy4Vbn6C2vwU2pJHuGAa5lDQm_-e_TuVnWW8x_TS5K2UqrAK5QInSSGndfRFPSxAdJ5JfzliEj2VsP0kdDJjH-ZNg5NfwGpN8QhHqPEpm1_VTJrGwjTZQfK86vNPcH6ZpAEvOUO6Jedgg4_HbN9oeTuecP05yP2d06HshyZpQDp_kw_M4sYNwmlvVm_vMldmvd5PBo8dLaaAvF4uSM-fEfwUg3GFjxkiTf2JD6j8YuVtkx-jcLM7tKGYQYBBQW30Uc5jURwq5PMo20HDJWgTz_8L6M3Vxjz02US7i8d_fjJR42yoFuUZcydud4PIP2YbRYeTJmTtIj9RsG6BPh5CfrRc6Qg9Be8yUCzhO-kNcYsyYI2drlh778mO4ymAAgCbmEoxh8FTUQP5UmmtFQwjRJ8ILsx0G7b47S6bIOwjeeWRAy6I6a5KJiq3SugrYOMXALSvTZyMwCZ3rjuVnARXEAybBFi1wGdl9ktdSYyMM97UtVIsccV1Bk9rIGYKu4Qx25oF5kei7xfwg60Dtkf6bJgEafwsDVrLPB53NkhOrzCzAqTxQL2iwp2ja1aA7-5ZluaM3IpulcKBOUqdNQYe02AbgOXKdYG-Cs_uMP-EaJ-Et-QWpfJuAhPJYlbJgm4gIS8qtiZkRU8Pxbv_bY_kv0vEtF6mgtAYOnrJdbmMuZyl9O1tp-LWDoi5k5VX2UhBchbzALisLnwNcYsPvvqQElK9qPZkIN4BVvyWjyavCeh9Q5t9rnJqLk8m7vN7oKrbe4CWH3K2IStA8rJNC624vdk3yK4vtlmnEpNZZEBcVlgbOprRilWo-JGjkgBK5gkSl794kqYXlKhua_DQ_aR5crh2fl85lrK1TMRThAohrnFQEs_uY6cTLyLa6rBWYp1FYLROqtBxHAmuQF7IydLIahmL5x3nDdq_PluGD7AliSM0GRPQAayYnyDTYiod7kZmlsLECY&cid=CAQSSwBygQiDXwNd7INBv5rUFvwg1OO4WXhqnKqwoWwYjoXNK-TAj_-fHg3ERs-21nQwEiScW0bilGn9ZRLHZ_gvJIK7Iyg8kCmUyD6i_BgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=5815852324295181000&adk=548554675&idt=165&cac=0&dtd=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eea88861c60dda55fe15b54c8e8f300fc2c01f5fab2625321d9af973c6dd5421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34222
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A2E7 22 KB
8 KB 39ms
38ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 9820
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 12:31:45 GMT
expires: Mon, 29 Apr 2024 12:31:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A85 0
20 B 139ms
139ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8857569586127&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A85 0
20 B 138ms
138ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8857569586127&version=m202301230201&ct=77&x=1&cor=9262389176477379000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5A85 15 KB
11 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AeFk5R4RgKSnGbR10Id0IwFc_KXNhVTLJDOHugEGo0dqdOuy7dWhHhZDqbl7Y9A3jkajGKNsTbP74omaZCfVkL9GZeU7fQKNUfXmnHhoDtaRMWcehecy3LLuhGfttoNhO0q57wx6nt23XevXS_37aV7ooCB5COtVrTJjuRls8tzOkBNCg&cry=1&dbm_d=AKAmf-ChYhYnPeUCZ7bVNJ23gOEX4ORF7fDL38PtwHt2qw1tobyfUe_NuF5jAupECCVJe4hlgffHqpfH3xR6RVPLx42cwCRsh2g1D70ZCWKODaJBI9A3X_z3gU9WA65sMgsYFBQzuqH5ekRzy3B9c7QhSiKx22jQlNGT0FZR9xzmUYjNFWW4Fx_1AXArUkxi44HyT0tGvE_SIVYD_6bZLvrYmegC-UhTTLEnn0D3-AokECLjPrKYa4B9SXG2rvtCb-4Yz4uVy6Mr5xFFqyZ3TxzzCmCFXq8_Aw2CCKzuC6mOQNZO4CMt5GTu1ByFXXEzCqIhJfZjXnkVYyl0uOZBLP9QR4y2iveq4gCZrjVD5ivIMtY5UP4_C4Cx8rgxubYhT7K3GqXKU1pGYN5-xIBqRVfHIGxtodH0F4bUz4rtso_IaQJCWAfLSrpDy0QGAPLnx6HzfYLChfrB19HWqFE1FYzu7Gmp9HbUE6quUJU3AEATm26eh_28qo2M6xjF4bwXGeZyZ3dTTwKythjAHcXRC9rvhR7OX12vIZDSqhkVapu0VDoOjkkihtoZzGeBoM7rm9W9mNreToePtiZunt_3K7dW6JpeC7zYv7dK6IkI5gveGTirAeMAa0C1_ssOfu_FehRhveUJUSdvJkLPkFT0teXyZR0o7qXwilX0hIbbrAVRk_E_zEkre6M9C6HD7GzUb62yJPIGPZfV2we0VRfbxCfXyZMwpSatNz3U2Klir4pSkUkF48vC7USDVYryGHHxUntY3otcVO2VxHEInCiYD1iaxjiZhlDT3JId1m9Bm2baDiwewC1saX1aOvPtZuIa6f1AQU-8YwIOv9bPkqg7IfwbSMe2s0cz1ZOa69eUGKATspacRRSgilVlo3USUlTT3kWOz6evcsMKBAvLTHznP7UlhaTza512xZGgvIEEVwCeZo_fYBg0iLhB2CLSMQiqT7KYRXc8jWproFxBjlZbkMKJ63CDm0XGoQ9h2bEN7H03RisLfir1kRkJVVQpqHTLHiRkMhPNM0W0XWioBTSWYEjzlfnrWxs7heznZzS6GrVq7a5ViiOAikZixHauspk0TXuS_7MyE-fkoLa7Of8LUcFncfepbaAEUKVDRMpgd73MiRBbaz4ulr1TUJ4dHcbDR0MZDpjtUcHusVceoBCA4uAa3gS8RCVhA9dtIXFptZbsPj9eE1MyfNEnppV8bRS9QQ9ONNP9pTsPpszXwgCQxxKzkwjwn9U5Fl6_eU7OvJXcQLvAcIx_cgXoBQj5rposDsMrH26MeBzAOGNSb-OMa4DzAtXDM8JxKaUS5ZqeB2WLcjlaKf1W9hzKB0lbC_OAXdhQU-9fnhRvSfiXAgzLZIA17uTf6n3_VO480JsjRwlEYyi3rUYbCuDAeSD7t7fyTCG-iA7N3EjGnKn7vvEzMV4hmmzTBT8jlaZ6eJxVE02QuSn61hVTK67avAmAjhAteI5lrnYOTWsgk2bOuOpAmePOZqJ0JsJaO26YHt9VELqyib98wNnMqjV7um_1_7jZCrvuYL5LHj8Y5p1uRx1eYeZLWGEjD1AeKsgyOc3S89KUGhLkTAQYX_iXGC5HSvkbBKuUvzJXTzbPK7fWHttFJWQ51St-OBjsRxhXlv6UDpqxPromxAfAV-wWfhc1sBO2o-_IYkmX7i8eVwvWmu4kh699oxg7u1PaYS6Xjt7oaGCfsn_8fejw6eJAnVpfncPBhRcrdO4T_6aju8grFmJe6WLtHVZHNxDdlA8UTSvv4woeKPgReM0OkGz386xxpbl21oOUQkui4fCxmvr2VQGTMO0qTMVNFP2H1mhveSrefGmRsLlH0GdSDqN6zmu8XgGV26n_-z45Y-G80xrwRc3Ngel5k7gscTClmg-Urf-gi-B5yEj0C2OKizzJe36DPeSnX3P2N95EmyFQCgHTca5MweX1wy7zTedyKUqIRnp8HlOqLfd3GWcn9HW5ubU2Dh2dk-7a2_sJDm0a75pOwXm5fmk0J6dctUlTx5WwLo9Ezw5F2aEM8kikdFZrezNhN9PGLLSh6VHfTNAdPVIqDaCTf3GDCBI66bqUrS334CW9NwESO0odlfpykuNVP8_JBqbXlaeyqFHUJYMPnlcobZSbAWjNY8EkWirdn_97ndLIvejDRW6EUdZrbMx0HaPKMt8RJrzWnUYEqFpQiV72XIMre2-bzmTCvAJva_sNBbzc8O9g5PJ0H80iAZXM_cVMYAy4DPyo0j2VSyWxhOvX7rxFdNYJy1WsQQoivTrYabRkb6Bbu8q2CVvw9h5BuAz1goTacGmrECNAn-wfXss8CKrOT6852C3iP-Uy5GwCfeY0rT1ZIO8_2t7mV1EjmqU7aTchaUa-LzxpkBGuiiLCaBD_ZDL2FrnM15AGRJo5Bx43ajlFDcBgoiJcpcL3qLNuGSO8iECXZwsTtqoD2Mbws2jZ7iVhf3qZgS1VzJui2RQV5ixXeoqFLbM5-04XHVqyl9HV9pL-MJeaVK7JFGyBRK0gFDzo5Uoy6YyUNIdhTUWM0qrDDAZoeFeWS97gsOghr78NiurCkt6xsVkCa9TqajISTA_sQQKgtpirvxb83N6qdQP474LLAE7vkc2kAsQD1Niwk4rXNaw4mJslyvCJ0joJb7W_JAnkMfb4Qg8R1unDW8Y28IISJTN03F9er3Du6AUjzOGn0mzuijHaiZfDGV9ac9Sq_B00AQRBJNhN_AWGIMFOcRS62K7-HAe_5WTeYaTO_ju1Nhi7GYkpmUOkE9dLKbt-SZ-tpUQjqC-DiWifV63LPkcq-oqtEiutwopQaViofIhtruIbRXBISXYxFl6hRsSebJCiBMGbyPKzh5xuSbrCT7ZwsXGrZASts7nq2w_tYY4XXc7xgnTuhLVAlCV6E7VJkvVJ-k8nNQJn5N18xwsNGgBgszEX-ynET_RQ-y-hi_X_jEnDItFcle8BZHDQCa_0JhFcHs4lJ-XKA5oVbO_dBEE2Inl3eu8oSRnSFdGbSPlgcF-WsUmSEgFsi-5m-3HKgN4bge7n2dLzTjJax90H3mMsHq5DRhOFnu6rlGG7XiY_tv5pw6DoR9fubm-7UQlFMyPKnEquylQDh-pwUnA6zSuHip6u8UxdHJGseo73w4F26vBluMxmoZIsuuNNnwyheL69uaDuH-5jornspMWTaTcDqvAFgSFaH_cnX8mdE5SoQqjlh0o4gLrnF7iWqXbInQzHpa6Dfw&cid=CAQSSwBygQiDPl7sx6xY7gUI_8XZkQxS-8eD3S2r1HOzene8fbjkfosBY9TKqxF_J_BEBNWzHFZeHbrRUd5k_5SfSGDEEjzJziF8kqQp6hgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=9262389176477379000&adk=2975593758&idt=191&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae10d3d6ff3d87a1ec24d04f044ad8f6d450469ddd755b9f50244dcdccb383d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11225
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 5627 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: afbbdc0819f4044cae8d0ffb190d2bb5f00af7744bb6091b7ccc12113858bdf1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

sid Show response
mug.criteo.com/ Frame 2388
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=earnme.club&sn=ChromeSyncframe&so=3&topUrl=earnme.club&bundle=Q_bN9l8yZ3VLb3RvRUd5MHJpNiUyQmsxZTVQRFhidWVwSjltU2glMkJmaFZhYyUyRlZUTlpCcDdy...
https://mug.criteo.com/sid?cpp=v7slG3xsa3A5VVZqODZmUklNcm95eFY5ai9xNkVnSm9KZk9ZdlZjY25SWmtuNVdUM1ZpamQrczR5d0NxSXgvRnRWVERXcGxGYmZxYlB4bEVmdEJaazd4d2FLbjJzYXA5L1hLQ1ZyYUxRd2JBN3AxMldXY3I0bmZkSkMwV3...

441 B
657 B

20ms
19ms

Fetch
application/json

178.250.7.13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=v7slG3xsa3A5VVZqODZmUklNcm95eFY5ai9xNkVnSm9KZk9ZdlZjY25SWmtuNVdUM1ZpamQrczR5d0NxSXgvRnRWVERXcGxGYmZxYlB4bEVmdEJaazd4d2FLbjJzYXA5L1hLQ1ZyYUxRd2JBN3AxMldXY3I0bmZkSkMwV3FXLzNyeVR6Y0ROYit4Vkk1UmpXTFFtdURqWjJLUXNzMHNzcTZGTVBWV0g5MUp3czRXeGtQZk1LRlYwNEVVczNwMGVZOGZuZW1yQmZXc1JGTnJsTmZSRHVmTEtMcjBJb0h1akhuTTJablZzeGNuK042VE5hWGZFVDZYT0VUMGRHRnNSRExNeE5GY2tvTmVkVGovaFFaQWN4RlZmbE5lQ2xVYytRNTgxVkJXNSt5NWpRZ09OUT18&cppv=2

Protocol

Server

178.250.7.13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

bc35c9a29fe24bdc0b2a499f9030cae5218800b30a37e3b9a4b36f8addb42ab5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1443237
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:24 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=v7slG3xsa3A5VVZqODZmUklNcm95eFY5ai9xNkVnSm9KZk9ZdlZjY25SWmtuNVdUM1ZpamQrczR5d0NxSXgvRnRWVERXcGxGYmZxYlB4bEVmdEJaazd4d2FLbjJzYXA5L1hLQ1ZyYUxRd2JBN3AxMldXY3I0bmZkSkMwV3FXLzNyeVR6Y0ROYit4Vkk1UmpXTFFtdURqWjJLUXNzMHNzcTZGTVBWV0g5MUp3czRXeGtQZk1LRlYwNEVVczNwMGVZOGZuZW1yQmZXc1JGTnJsTmZSRHVmTEtMcjBJb0h1akhuTTJablZzeGNuK042VE5hWGZFVDZYT0VUMGRHRnNSRExNeE5GY2tvTmVkVGovaFFaQWN4RlZmbE5lQ2xVYytRNTgxVkJXNSt5NWpRZ09OUT18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 396340
content-length: 0
expires: 0

GET
H2 200 adform.js Show response
s1.adform.net/banners/scripts/mobile/ Frame 1BBA 57 KB
24 KB 167ms
46ms Script
application/javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/mobile/adform.js?1669130898142
Requested by: Host: earnme.club
URL: https://earnme.club/nord-n1-from-oneplus/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 6352477f7dd223e3def9197581b2c43e9de34d6220885483a00108be24acb741

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
content-encoding: gzip
last-modified: Wed, 23 Nov 2022 08:13:58 GMT
server: nginx
x-amz-request-id: tx00000b3cd54270b6d0de4-00637dd6a7-329354d9-default
etag: W/"244eff0f9d7ccb27c2d7a7be777f8112"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 stylesheet.min.css
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/css/ Frame 1BBA 6 KB
2 KB 146ms
26ms Stylesheet
text/css 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/css/stylesheet.min.css
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 6095d3fcb575040e15b107d84c0232718cee51137d2590afcaee269576bc1c1d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
content-encoding: gzip
last-modified: Tue, 04 Apr 2023 15:44:39 GMT
server: nginx
x-amz-request-id: tx000007166188d0614fc51-00644a2dc1-32957f68-default
etag: W/"3d5d8c0972f6842f52f1f5a6e4d95982"
x-cache-status: STALE
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H/1.1 200
OK gsap.min.js Show response
cdn.flashtalking.com/frameworks/js/gsap/latest/ Frame 1BBA 59 KB
23 KB 67ms
12ms Script
text/javascript 2.18.232.99
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.flashtalking.com/frameworks/js/gsap/latest/gsap.min.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.99 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-232-99.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 4f3078d79f59dca43390c202e38a3a25ff553362dade74143f41f7eb8046a7b0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 16 Jun 2020 15:25:30 GMT
Server: Flashtalking (AKA)
ETag: W/"bdce73d5a7b1c35344c2bb8df556926e"
Vary: Accept-Encoding
Content-Type: text/javascript
X-Varnish: 321281932 321143052
Cache-Control: max-age=72802
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 23640
Expires: Mon, 01 May 2023 11:28:47 GMT

GET
H2 200 mraid.js Show response
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/ Frame 1BBA 1 KB
945 B 174ms
54ms Script
application/javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/mraid.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 561f6655eaa2217e42357e80189b3f60a6dea1b2ab6eba64e35c83404037e432

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
content-encoding: gzip
last-modified: Mon, 13 Mar 2023 10:30:59 GMT
server: nginx
x-amz-request-id: tx00000e8015a04c17812e9-00644a2dc1-32950a49-default
etag: W/"4760c975b15c791037bde5932ddd9dd5"
x-cache-status: STALE
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 m_1.jpg
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/ Frame 1BBA 78 KB
79 KB 185ms
65ms Image
image/jpeg 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/m_1.jpg
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 337200fa98f6efb3cb86520e37b7142d577e304449b63fc1c65e34d6a2484305

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
last-modified: Tue, 04 Apr 2023 15:44:39 GMT
server: nginx
x-amz-request-id: tx000005adcc1afbaee70ac-00644a2dc1-32950a8f-default
etag: "72f3b6f0d63103eaa079642520a64c90"
x-cache-status: STALE
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 80189

GET
H2 200 txt__1_1.png
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/ Frame 1BBA 4 KB
4 KB 195ms
75ms Image
image/png 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/txt__1_1.png
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 3251b0d8d08473d70115a27162a574fe4376d42026ece1c55ab7166b63f10a10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
last-modified: Tue, 04 Apr 2023 15:44:39 GMT
server: nginx
x-amz-request-id: tx00000985bf601197a071c-00644a2dc1-32950a49-default
etag: "d911757c9b9ed90d76bd81c695588545"
x-cache-status: STALE
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3687

GET
H2 200 txt__2_1.png
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/ Frame 1BBA 4 KB
5 KB 195ms
76ms Image
image/png 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/txt__2_1.png
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 18e521a5d0510315ef33808b763b097ba1e9778b5f788bb458cb2b40c75274ac

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
last-modified: Tue, 04 Apr 2023 15:44:40 GMT
server: nginx
x-amz-request-id: tx00000eb8cb93d997bc806-00644a2db5-3295d06f-default
etag: "1467a6e6b380ecc97acb4c9dcc245805"
x-cache-status: STALE
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 4337

GET
H2 200 cta__box.png
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/ Frame 1BBA 2 KB
3 KB 50ms
49ms Image
image/png 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/cta__box.png
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 78f9c1e43e2415f0c776b894740117b4df9149b0c3cb0da6ed6c6a163a20d3af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
last-modified: Tue, 04 Apr 2023 15:44:39 GMT
server: nginx
x-amz-request-id: tx00000ba6f915bfba4e504-00644a2dc1-3295d06f-default
etag: "bb86fb2e8ee0a1807db1cd6d0ca16490"
x-cache-status: STALE
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 2552

GET
H2 200 cta__arrow.png
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/ Frame 1BBA 422 B
752 B 50ms
49ms Image
image/png 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/cta__arrow.png
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: b68411b5c2089d3bf7893dece808f91a8bec4cdb2efc3a6305fb239ea7bcf2de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
last-modified: Tue, 04 Apr 2023 15:44:39 GMT
server: nginx
x-amz-request-id: tx0000077d4bb60ff629032-00644a2dc1-32957f68-default
etag: "8971b8fa01b8135dc0bf41368de22466"
x-cache-status: STALE
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 422

GET
H2 200 logo.png
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/ Frame 1BBA 3 KB
4 KB 50ms
49ms Image
image/png 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/img/logo.png
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 50a754759056b8854eea40f5546ba7b21909f3d7187304b2a3681e72279fa12f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
last-modified: Tue, 04 Apr 2023 15:44:39 GMT
server: nginx
x-amz-request-id: tx0000074bc6833a7ca395e-00644a2dc1-3295a825-default
etag: "03eac2a3ba6842e6d921e579badf6028"
x-cache-status: STALE
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3400

GET
H2 200 pvm.min.js Show response
s1.adform.net/Banners/Elements/Files/2087214/12601399/main/js/ Frame 1BBA 7 KB
2 KB 174ms
55ms Script
application/x-javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/js/pvm.min.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/mobile/script/?CC=1&bn=63115208;srctype=2;ord=1854798809;gdpr=;gdpr_consent=;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CdGhRC4ZOZK29BZKx-wbsg4H4Dsnn67Bvjvn8gKARnquw5aI5EAEghveGJmCV4pCCoAfIAQmpAvfVlw-_fLI-qAMBqgTwAU_QaIeAmIto5YfoJKMjk9XslF7yiaTQKpmXHe1tFSRj1rifb8HmCIWCZm0OQ1OZTlbFJsAJMUbVRfz8W4W0xozEuIQOGDA03NuXd4WqMpHf-_T8jhofCmyYvAvTS3tiQAwpavfCP2NFBo2224xsSj4avno-K2DIOKL_burs8UaJg9e7Q00kFt0KCZKmureup16__g8GSoz1nDElos08jaFlSxEGlnvYsdCdbRWH2oCHrskDpC0YvIe_bX8yhl8A68H-IZP65t7dHr4_kRpIhYhP9TTQz9hG2Sv3heGQfaN708trUVeDmUOTEx18R6oQLsAE-J_vvrcE4AQDkAYBoAZNgAfjqJ2PBKgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIiOGAEBABGB0yA6qCAToCgECACgOYCwHICwGADAGwE8HQlRPQEwDYEwqIFAHYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSPgBygQiDJhaXy0P4W85MRV4XWiT6zLcxbi_2JcbHfVR9RpRFHgWr245u15pxCLXGilSHaASORMgGOwVF4DgAGAE&sig=AOD64_2tgMyK1L7n5V-TXKEJpouq8qdtgA&client=ca-pub-1062972861553303&dbm_c=AKAmf-DmZ2E70PTWjCI_ZmkSpghe-JGTZvUYbF1LmP8HMeygEnIL9EzOYEJhiKvtB4ydKgSfTbQYunUzP9o-tn4pvfdM-hUpN4a02SbNqC0cXYTJyHuMK41FeEtOToBDz_EGXjsuyj_bIS4cQCDhtxIi4W8fQyEUq-tGgGHUZe3Ddq2y-5gaNFY&cry=1&dbm_d=AKAmf-B1jnz_2xNVMJthEYFDWvW04filNhUFXx8Z7ReqyNusyyIdBHGpxhi9csIhEw-flrHjQOwuxd5QsRpeYKqjaHEHsx5jlIEe8zEv3a_n0Mz2lUmqvGcLUDImk0Q1VCowNCQRjQn96jKEnutd9B9oRHMyRVTT3NWdQB7AlwPIZp63mwTgx2t1w4eqtwW1TWT_VMmQexhoF4PsIP0cFV2lbAHmNmq49p65Y2z1_rz1FLr4Pb1hn_Kx4wUr4N1jD5jjXh9TEqqpi2B1lDyerlwPTGlVohqNII55YKPFE-GnW2hM37oAfJZ8bD4xi6jahuqeBFFxpgWiBs8EXMeUXjKVvq5qwliyw34Gi6w2YjNRwi1THO4dAoSDzgM9lNaMoiSgkkwfnVxzuZU919NTUp4AjGfCAKkfFYk9kOlM2ZCYejRU-ckrpEf9VMOV_y3T6mb0e6QnrTLhPaHqSsTnRoFueXJ7gXFAV8KF88fjxt0xSD5w1OxjcUwOj5idJ3N4T6HD4FdbjHOb7fqKQ7p29QwDw6nZmVB9i8kWxg287_ScuoLEEmvyNuI&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: ffb9beeac0b797a41b0aa254420decf3e28417c6d2e171a56ea0a48dfac7d8ba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
content-encoding: gzip
last-modified: Tue, 04 Apr 2023 15:44:40 GMT
server: nginx
x-amz-request-id: tx00000ee1809fe2013a3c7-00644a2dc1-32950a8f-default
etag: W/"fe7628eab62133fc9155e15324f7c678"
x-cache-status: STALE
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9020 22 KB
8 KB 39ms
38ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 9820
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 12:31:45 GMT
expires: Mon, 29 Apr 2024 12:31:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/ Frame 8B82 28 KB
11 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CHTFTHEhD_BL1ILcUUexRpjbkquY3cZdCUQqefkjZjGvnCWR7ldmA6gF68HxUYm71-iKRiS7NbAHGQBYJxcyYfEpC6Uw&cry=1&dbm_d=AKAmf-AfOD9hTq6rrMn7wGxfh9mqonKmyWZBff90MEi--fz-MxX7BGGBBrc3CK45Ta3e6KZAcSD9T4CRprSViA4RQpfLyMGnZcss5FCwKBTJ4CB8XqT3JL6n0bIrX7CV7z7UP_zC02cUSkrxkQ8A3YumHevfhklsYuanjmt-vGAbh1bL4JK0aCQz9biWYeb9qIBW0HHMtNtWWgML5QSPRY2C62z_d5pk7NhVVEBpIXstABcw6mEcGdn6l8lnwqNXfkGH9cJQRXnpfvFBWPmzuEXD4sMqxTAuEhS3IjGj85lLlX6sby9sARv2O0gkOpYfTDT9WGdSABvHIh1huFMb-rFbtmwUhfD0LTe3MVfhQGVR8PTkjNwE2xpyVC9qM5jt9j5Id3k_pvPPxJ-ZC-TaUkMepx5ipFDN75vWVQFpF-OQNbyuBTIqRdLo1c2D8lKpmcSwXOS_YeTMUq98WK8bekjJLHXtBkyw6KkTA2ZffFLmC7jiDcnKutQmjZX1fH6PUChvbkTsVbIEfbzlzKOkl8wNorFfOlGDnNRMuD9RU_aZDXcJxU_VkKlylrIca-lsCYg9SD6-2YBMwm2onD9SxIglHtNvSKjtYPO9g5Q8hBMcCpGkLgK_EgdXuxXBHhEBIcG2sJx5FRbpYR6ywXj8OJIiRN6RaR7pBFX-rVG_dks4juv39ImsCAyVYnyHdNyoa60B6a_2VEJDmQB9L7m0CXDP8takH_pzr9M17vTiVXAdlyRhzEuVV2YGsCxF44I4_ht2LE-ktUlBcWGymOFNItrlWPNPEpevv8gCetNAlqf9oIwREdrUVNKCA_jezn6mQHmt4xJtkcC26V_aOnRe6kCGxDLVwaN0xK2b_OaHqbye6fweXxuLRJT8NNKZ32nxdlX9WW8kRUukBXTdaIyuCL9J8GiBggfTpL4xb-qOVNng7KJiXF-KCKrBZy-2AeeRGhy3InPh4UtWVeTkBsqHFIENGrJn048RFCdBJgShVy62AYu7DObGFJX7736XH6gJIY1Rmo47ABtKyyfeCsBXubAVfGAVPdn72ZocwaZ2qX4_DjxuXKK8iJKiIUfCSwiq_pftcqbXBkvZr8S6pLmBnAHHlx6Zbgc4sB_6SGno50eg0Wsny0qtPV_iT0jUJiozlaYR5gwV-KlbqjDX4x9Qk4CYJfFSGUkq78zw4lqKvVtIByUadBlqB1-jbyAxlVIyRg_wLLrkCZsUOO-hbzAFvc_A2EhbakpRpqZBuICDSEOnCeomR4KUx3zXD4aA_b0OAoyufIQUO3KPEzJBelsU66or0-Snzv0d9msYwlJNk2ES31bifF_UprzpyOMrv_pTT_joc5E4A063In7m_K2c86kztkt6DnKYpVI0JyDpyHiqLw5J63ASfi70eFtIX8ReXOyTw3jhoTM29lcSwtldMeI8li-0SE6g8bKVxP19QJFC43EzsQ5riQoBUB8qYa_st-IAD5zwLsKBD_OZt5YWWaA3OO0p4GR3N7ah-XuQZb6sKOMW5OIW5pke14-Q_Klvqd-KLWzHrlK-X_MvPGnVT3rsBJwo0IqPhuF4bq96wJEog6-87w2Z1dcNdvdXuBxEwycemU4OVTsrMgihqxTo8eEuIGV1Fk4H91bQXYrrgZTL4EKJJxPGDaM4PiucL1R2OxsZHPzd8NfEmmDxfyPDpe9cTWbDtnXsUAg2nAVhr6bbXgo--YNjohDk52Xenc0vyhjGkODZZhEsfgB2lPiuvgKFhCd_Lr3O-Uxdq0Mk5q8WFnoUYpBVKFMQTYa3HxHefyAbDj3NHrZoTi-niQ1SHLHVPXW4HdkrHKJJVdzZvjFxgTQY_fRc9I7pzQRKqTPuHfLKLWppWTfq9lONKIwbpiT59WZCAOex-ZSx_ruL10fiGnxsbiFeBFBJPZ_GLSfNjHGQcAYmyh4CyL5wezvW5PYON0Yn1mE-8QuwTddYXzMplfS9NAyX623dHKL1-hvZRBAc26zRkf1DIcAf6dd28eRQ76pvh0RODXH60634WhoRDf4Krkvhx6vAJmniEgvyI4CA8jn67a7fJ1vstkhMhxRXEWKhsd0bAyGafKmactm285pJadt46wMiT6aeBlWO6giMr2VwQXijZjBUPrld8HAGQc6Qsbd88ndbYLjR0WJxgmTp6C0qEA4OJYyeJCGqYFwWFQJ-q3W4E80J7kyAkmFJoPHjKqr1m07tDk1348t1q3KGzrdnk-9LQEm0NdbomywTiKz2tB7q5FIeIoOnHlKY9nFcNUF30NAOrzw-ZyKV2fF2CVCz59nsv24-5THY8Bakd5omOudHA34CQDbyb5GRkrv3erJjUY8nkqaXleJjdDgd8ZO_vLsOyZd4pUBTqXstXCohwLOZY4ihFDF72nO0aUV1SJIhGeg3QYjStEooWpA_h-x9A6Efj-FI8nQXMw5Z0EHHtHy4ST3U9k69p2rCtot3FFzBURabqP9vbQ2CkklGFjy4Vbn6C2vwU2pJHuGAa5lDQm_-e_TuVnWW8x_TS5K2UqrAK5QInSSGndfRFPSxAdJ5JfzliEj2VsP0kdDJjH-ZNg5NfwGpN8QhHqPEpm1_VTJrGwjTZQfK86vNPcH6ZpAEvOUO6Jedgg4_HbN9oeTuecP05yP2d06HshyZpQDp_kw_M4sYNwmlvVm_vMldmvd5PBo8dLaaAvF4uSM-fEfwUg3GFjxkiTf2JD6j8YuVtkx-jcLM7tKGYQYBBQW30Uc5jURwq5PMo20HDJWgTz_8L6M3Vxjz02US7i8d_fjJR42yoFuUZcydud4PIP2YbRYeTJmTtIj9RsG6BPh5CfrRc6Qg9Be8yUCzhO-kNcYsyYI2drlh778mO4ymAAgCbmEoxh8FTUQP5UmmtFQwjRJ8ILsx0G7b47S6bIOwjeeWRAy6I6a5KJiq3SugrYOMXALSvTZyMwCZ3rjuVnARXEAybBFi1wGdl9ktdSYyMM97UtVIsccV1Bk9rIGYKu4Qx25oF5kei7xfwg60Dtkf6bJgEafwsDVrLPB53NkhOrzCzAqTxQL2iwp2ja1aA7-5ZluaM3IpulcKBOUqdNQYe02AbgOXKdYG-Cs_uMP-EaJ-Et-QWpfJuAhPJYlbJgm4gIS8qtiZkRU8Pxbv_bY_kv0vEtF6mgtAYOnrJdbmMuZyl9O1tp-LWDoi5k5VX2UhBchbzALisLnwNcYsPvvqQElK9qPZkIN4BVvyWjyavCeh9Q5t9rnJqLk8m7vN7oKrbe4CWH3K2IStA8rJNC624vdk3yK4vtlmnEpNZZEBcVlgbOprRilWo-JGjkgBK5gkSl794kqYXlKhua_DQ_aR5crh2fl85lrK1TMRThAohrnFQEs_uY6cTLyLa6rBWYp1FYLROqtBxHAmuQF7IydLIahmL5x3nDdq_PluGD7AliSM0GRPQAayYnyDTYiod7kZmlsLECY&cid=CAQSSwBygQiDXwNd7INBv5rUFvwg1OO4WXhqnKqwoWwYjoXNK-TAj_-fHg3ERs-21nQwEiScW0bilGn9ZRLHZ_gvJIK7Iyg8kCmUyD6i_BgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=5815852324295181000&adk=548554675&idt=165&cac=0&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

750d70bfb8a9982b827656699387de0b63da65b2e9a247768005d9775bad42b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68858
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10878
x-xss-protection: 0
server: cafe
etag: 6410051166583139006
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:07:47 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/ Frame 8B82 11 KB
4 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230426/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:07:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68858
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 13 May 2023 20:07:47 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8B82 0
0 81ms
81ms Fetch
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvaiB1NNEdHz2azSNspnE7nFiSdNGwiOhpi1M3Ykf75sSVTOfAWgrRnBGRSsFocpvEe02_ypKg5F6zDKcaQMXqsBKKD6j3sPXkIrDC_dLgJzfbEsuu7omEBNzqEO4Wj02HzS91pju_LzyzBz-YFU29Lem9oe3eLRabEJt9JGdPAhYlermmKYuDcRw_I2Oy5BfrdZukofr6QYg9eCWlurTWQcg6DWbFNWCWnyw0PNd7cKzBadTJiGLtb4w7WhcBnNuEOYOKsV4mC-6cawP9C9JTmqjRiM-ML5qzIUR4IqIZ2GXKWnDk4pmaJGU71ja_7wm6O93jFj5byVslaLRrIa58wjQzlst-TEl7cdixI38_7GSUyqF61ZT-n7LfiDoni7b5gxcuMRT86T92Nzv2-5YJJb-aT7ZfkYeZGFJd_vYk9uIhqIqQNW8WSQh0EVE0x2-bbfFZCJi34_rWGcCXIAoTixlV_1uJSkpSWWB7gQvX9Md-5ng1D-CDH7ykqQrU8_6unQOlStl7Bmtx8snddoY2xKyzOyU2N9AITZ0vDFmXntwgJfuJuEiT1juzjEpdmYwrDjfE7g-qYqhFTI0AFrd_UWndTjQkmTrmSdHXy7M7RbFEtReE2Kme0FTVKFpQjsqKlqEsNo7YA4q3KMoGj_BxWaBHOYnTvOk7nXkiz_lNgpJRwRFJFFjFLbAtacx_25_u_NkZ7pTENh4rMY0KZDuod7nUeqS9IBMRyOR1_vmWreTtsOS1VGff5OcL81NOReByBiNa1PuxgDPx7SqUi-MrH-7WXqQFUZm5yM4uD1UNF8cSqQX3-JV2dwjHREsJxQ86x9lHIKUFjlx__G4YPK3tzoynKKSyLnUP-JPexmQ-j9u4yL-RbikVB7QOXA7qeEngxklrJxMgkXHpOynspepE5D-ZcYx5Pkd4KOVf1x5iaCw7aTiwgIEXXNXG3GrEQwULU7rhBnjH4fpQGsnr5ZiHo9VqryDjPVeRRiB22bstQabsnAc1XCZhbrUV0KUNarjK_SeyA8-4X_oUDTTqRRz8Wk_iQXGPE1rY8EWMNeaGwvwOyT4qlKwEnj9rkMGZtUdhdqb_IM9wBMsedatAKRcqN7-uocMvyofIIkDhY3zvG4ASyhGwAxSC5G9fHvFMrBVJOd0-uqsRMYcLtudGquMY9QcZlZ2cOdOBuPYoQw7_3gP-RmIJqPRtSTYF0kyl6jBSEo5UkcIU25o8&sai=AMfl-YRHWcCw-RTphP0W5HwqUFRNrlFtkV3hlZoIu7CD6bqXGxVlsY9nxvChhlHKrI2XSlSV7Ge68AwfxYul03uTbV_1eaV9GM_tg6CVBLjbDXlecEFQwpK4PtdV9wI-n2-86lQoysoqCtUW66PAcz4eunuBaD6TP2kkjTmYkXqBMw-a0dsMdq_NPQxII0hrp_Ch2ORaHxlRusC7tqCJj9ZvjLutGhFerzYvD2ItD6Biq9yNGUjcY15YoiJY_hastzfG5ieqeOqIMqwRiNbwVxHfQG3mMsa-g_V4&sig=Cg0ArKJSzA7VJq-MSRJCEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230426.40507&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Sun, 30 Apr 2023 15:15:25 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8B82 41 KB
15 KB 43ms
40ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 26 Apr 2023 14:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 346842
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Apr 2024 14:54:43 GMT

GET
H3 200 10866601458923796400
s0.2mdn.net/simgad/ Frame 8B82 22 KB
22 KB 41ms
40ms Image
image/jpeg 2a00:1450:4001:806::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10866601458923796400

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

69400060a0624356bfce9364c4134b042a9a26a9d8c14699ff27a51b77bdec8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 23:55:21 GMT
x-content-type-options: nosniff
age: 55204
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22164
x-xss-protection: 0
last-modified: Fri, 24 Mar 2023 13:04:09 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 28 Apr 2024 23:55:21 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5A85 41 KB
15 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AeFk5R4RgKSnGbR10Id0IwFc_KXNhVTLJDOHugEGo0dqdOuy7dWhHhZDqbl7Y9A3jkajGKNsTbP74omaZCfVkL9GZeU7fQKNUfXmnHhoDtaRMWcehecy3LLuhGfttoNhO0q57wx6nt23XevXS_37aV7ooCB5COtVrTJjuRls8tzOkBNCg&cry=1&dbm_d=AKAmf-ChYhYnPeUCZ7bVNJ23gOEX4ORF7fDL38PtwHt2qw1tobyfUe_NuF5jAupECCVJe4hlgffHqpfH3xR6RVPLx42cwCRsh2g1D70ZCWKODaJBI9A3X_z3gU9WA65sMgsYFBQzuqH5ekRzy3B9c7QhSiKx22jQlNGT0FZR9xzmUYjNFWW4Fx_1AXArUkxi44HyT0tGvE_SIVYD_6bZLvrYmegC-UhTTLEnn0D3-AokECLjPrKYa4B9SXG2rvtCb-4Yz4uVy6Mr5xFFqyZ3TxzzCmCFXq8_Aw2CCKzuC6mOQNZO4CMt5GTu1ByFXXEzCqIhJfZjXnkVYyl0uOZBLP9QR4y2iveq4gCZrjVD5ivIMtY5UP4_C4Cx8rgxubYhT7K3GqXKU1pGYN5-xIBqRVfHIGxtodH0F4bUz4rtso_IaQJCWAfLSrpDy0QGAPLnx6HzfYLChfrB19HWqFE1FYzu7Gmp9HbUE6quUJU3AEATm26eh_28qo2M6xjF4bwXGeZyZ3dTTwKythjAHcXRC9rvhR7OX12vIZDSqhkVapu0VDoOjkkihtoZzGeBoM7rm9W9mNreToePtiZunt_3K7dW6JpeC7zYv7dK6IkI5gveGTirAeMAa0C1_ssOfu_FehRhveUJUSdvJkLPkFT0teXyZR0o7qXwilX0hIbbrAVRk_E_zEkre6M9C6HD7GzUb62yJPIGPZfV2we0VRfbxCfXyZMwpSatNz3U2Klir4pSkUkF48vC7USDVYryGHHxUntY3otcVO2VxHEInCiYD1iaxjiZhlDT3JId1m9Bm2baDiwewC1saX1aOvPtZuIa6f1AQU-8YwIOv9bPkqg7IfwbSMe2s0cz1ZOa69eUGKATspacRRSgilVlo3USUlTT3kWOz6evcsMKBAvLTHznP7UlhaTza512xZGgvIEEVwCeZo_fYBg0iLhB2CLSMQiqT7KYRXc8jWproFxBjlZbkMKJ63CDm0XGoQ9h2bEN7H03RisLfir1kRkJVVQpqHTLHiRkMhPNM0W0XWioBTSWYEjzlfnrWxs7heznZzS6GrVq7a5ViiOAikZixHauspk0TXuS_7MyE-fkoLa7Of8LUcFncfepbaAEUKVDRMpgd73MiRBbaz4ulr1TUJ4dHcbDR0MZDpjtUcHusVceoBCA4uAa3gS8RCVhA9dtIXFptZbsPj9eE1MyfNEnppV8bRS9QQ9ONNP9pTsPpszXwgCQxxKzkwjwn9U5Fl6_eU7OvJXcQLvAcIx_cgXoBQj5rposDsMrH26MeBzAOGNSb-OMa4DzAtXDM8JxKaUS5ZqeB2WLcjlaKf1W9hzKB0lbC_OAXdhQU-9fnhRvSfiXAgzLZIA17uTf6n3_VO480JsjRwlEYyi3rUYbCuDAeSD7t7fyTCG-iA7N3EjGnKn7vvEzMV4hmmzTBT8jlaZ6eJxVE02QuSn61hVTK67avAmAjhAteI5lrnYOTWsgk2bOuOpAmePOZqJ0JsJaO26YHt9VELqyib98wNnMqjV7um_1_7jZCrvuYL5LHj8Y5p1uRx1eYeZLWGEjD1AeKsgyOc3S89KUGhLkTAQYX_iXGC5HSvkbBKuUvzJXTzbPK7fWHttFJWQ51St-OBjsRxhXlv6UDpqxPromxAfAV-wWfhc1sBO2o-_IYkmX7i8eVwvWmu4kh699oxg7u1PaYS6Xjt7oaGCfsn_8fejw6eJAnVpfncPBhRcrdO4T_6aju8grFmJe6WLtHVZHNxDdlA8UTSvv4woeKPgReM0OkGz386xxpbl21oOUQkui4fCxmvr2VQGTMO0qTMVNFP2H1mhveSrefGmRsLlH0GdSDqN6zmu8XgGV26n_-z45Y-G80xrwRc3Ngel5k7gscTClmg-Urf-gi-B5yEj0C2OKizzJe36DPeSnX3P2N95EmyFQCgHTca5MweX1wy7zTedyKUqIRnp8HlOqLfd3GWcn9HW5ubU2Dh2dk-7a2_sJDm0a75pOwXm5fmk0J6dctUlTx5WwLo9Ezw5F2aEM8kikdFZrezNhN9PGLLSh6VHfTNAdPVIqDaCTf3GDCBI66bqUrS334CW9NwESO0odlfpykuNVP8_JBqbXlaeyqFHUJYMPnlcobZSbAWjNY8EkWirdn_97ndLIvejDRW6EUdZrbMx0HaPKMt8RJrzWnUYEqFpQiV72XIMre2-bzmTCvAJva_sNBbzc8O9g5PJ0H80iAZXM_cVMYAy4DPyo0j2VSyWxhOvX7rxFdNYJy1WsQQoivTrYabRkb6Bbu8q2CVvw9h5BuAz1goTacGmrECNAn-wfXss8CKrOT6852C3iP-Uy5GwCfeY0rT1ZIO8_2t7mV1EjmqU7aTchaUa-LzxpkBGuiiLCaBD_ZDL2FrnM15AGRJo5Bx43ajlFDcBgoiJcpcL3qLNuGSO8iECXZwsTtqoD2Mbws2jZ7iVhf3qZgS1VzJui2RQV5ixXeoqFLbM5-04XHVqyl9HV9pL-MJeaVK7JFGyBRK0gFDzo5Uoy6YyUNIdhTUWM0qrDDAZoeFeWS97gsOghr78NiurCkt6xsVkCa9TqajISTA_sQQKgtpirvxb83N6qdQP474LLAE7vkc2kAsQD1Niwk4rXNaw4mJslyvCJ0joJb7W_JAnkMfb4Qg8R1unDW8Y28IISJTN03F9er3Du6AUjzOGn0mzuijHaiZfDGV9ac9Sq_B00AQRBJNhN_AWGIMFOcRS62K7-HAe_5WTeYaTO_ju1Nhi7GYkpmUOkE9dLKbt-SZ-tpUQjqC-DiWifV63LPkcq-oqtEiutwopQaViofIhtruIbRXBISXYxFl6hRsSebJCiBMGbyPKzh5xuSbrCT7ZwsXGrZASts7nq2w_tYY4XXc7xgnTuhLVAlCV6E7VJkvVJ-k8nNQJn5N18xwsNGgBgszEX-ynET_RQ-y-hi_X_jEnDItFcle8BZHDQCa_0JhFcHs4lJ-XKA5oVbO_dBEE2Inl3eu8oSRnSFdGbSPlgcF-WsUmSEgFsi-5m-3HKgN4bge7n2dLzTjJax90H3mMsHq5DRhOFnu6rlGG7XiY_tv5pw6DoR9fubm-7UQlFMyPKnEquylQDh-pwUnA6zSuHip6u8UxdHJGseo73w4F26vBluMxmoZIsuuNNnwyheL69uaDuH-5jornspMWTaTcDqvAFgSFaH_cnX8mdE5SoQqjlh0o4gLrnF7iWqXbInQzHpa6Dfw&cid=CAQSSwBygQiDPl7sx6xY7gUI_8XZkQxS-8eD3S2r1HOzene8fbjkfosBY9TKqxF_J_BEBNWzHFZeHbrRUd5k_5SfSGDEEjzJziF8kqQp6hgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fearnme.club%2F&ds=l&xdt=1&iif=1&cor=9262389176477379000&adk=2975593758&idt=191&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Wed, 26 Apr 2023 14:54:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 346842
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 25 Apr 2024 14:54:43 GMT

GET
H3 200 C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js Show response
pagead2.googlesyndication.com/bg/ Frame E108 36 KB
14 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 09:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14118
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Apr 2024 09:57:47 GMT

GET
H/1.1 200
OK dvbs_src_internal117.js Show response
cdn.doubleverify.com/ Frame 5A85 57 KB
19 KB 8ms
8ms Script
application/javascript 2a02:26f0:480:9::210:ee05
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=15911784&cmp=203336&plc=7322076&sid=18330&dvregion=0&unit=970x250
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:9::210:ee05 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: c74d4c8be63fda641c0e0255ad3c7416862f17e31442a1a0ddd7645bc2d69d3c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:25 GMT
Content-Encoding: gzip
Last-Modified: Tue, 10 Jan 2023 11:00:18 GMT
Server: Microsoft-IIS/10.0
ETag: "0cda5b9e224d91:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18840

GET
H3 200 C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js Show response
pagead2.googlesyndication.com/bg/ Frame A2E7 36 KB
14 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 09:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14118
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Apr 2024 09:57:47 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8B82 0
0 74ms
74ms Fetch
image/gif 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvaiB1NNEdHz2azSNspnE7nFiSdNGwiOhpi1M3Ykf75sSVTOfAWgrRnBGRSsFocpvEe02_ypKg5F6zDKcaQMXqsBKKD6j3sPXkIrDC_dLgJzfbEsuu7omEBNzqEO4Wj02HzS91pju_LzyzBz-YFU29Lem9oe3eLRabEJt9JGdPAhYlermmKYuDcRw_I2Oy5BfrdZukofr6QYg9eCWlurTWQcg6DWbFNWCWnyw0PNd7cKzBadTJiGLtb4w7WhcBnNuEOYOKsV4mC-6cawP9C9JTmqjRiM-ML5qzIUR4IqIZ2GXKWnDk4pmaJGU71ja_7wm6O93jFj5byVslaLRrIa58wjQzlst-TEl7cdixI38_7GSUyqF61ZT-n7LfiDoni7b5gxcuMRT86T92Nzv2-5YJJb-aT7ZfkYeZGFJd_vYk9uIhqIqQNW8WSQh0EVE0x2-bbfFZCJi34_rWGcCXIAoTixlV_1uJSkpSWWB7gQvX9Md-5ng1D-CDH7ykqQrU8_6unQOlStl7Bmtx8snddoY2xKyzOyU2N9AITZ0vDFmXntwgJfuJuEiT1juzjEpdmYwrDjfE7g-qYqhFTI0AFrd_UWndTjQkmTrmSdHXy7M7RbFEtReE2Kme0FTVKFpQjsqKlqEsNo7YA4q3KMoGj_BxWaBHOYnTvOk7nXkiz_lNgpJRwRFJFFjFLbAtacx_25_u_NkZ7pTENh4rMY0KZDuod7nUeqS9IBMRyOR1_vmWreTtsOS1VGff5OcL81NOReByBiNa1PuxgDPx7SqUi-MrH-7WXqQFUZm5yM4uD1UNF8cSqQX3-JV2dwjHREsJxQ86x9lHIKUFjlx__G4YPK3tzoynKKSyLnUP-JPexmQ-j9u4yL-RbikVB7QOXA7qeEngxklrJxMgkXHpOynspepE5D-ZcYx5Pkd4KOVf1x5iaCw7aTiwgIEXXNXG3GrEQwULU7rhBnjH4fpQGsnr5ZiHo9VqryDjPVeRRiB22bstQabsnAc1XCZhbrUV0KUNarjK_SeyA8-4X_oUDTTqRRz8Wk_iQXGPE1rY8EWMNeaGwvwOyT4qlKwEnj9rkMGZtUdhdqb_IM9wBMsedatAKRcqN7-uocMvyofIIkDhY3zvG4ASyhGwAxSC5G9fHvFMrBVJOd0-uqsRMYcLtudGquMY9QcZlZ2cOdOBuPYoQw7_3gP-RmIJqPRtSTYF0kyl6jBSEo5UkcIU25o8&sai=AMfl-YRHWcCw-RTphP0W5HwqUFRNrlFtkV3hlZoIu7CD6bqXGxVlsY9nxvChhlHKrI2XSlSV7Ge68AwfxYul03uTbV_1eaV9GM_tg6CVBLjbDXlecEFQwpK4PtdV9wI-n2-86lQoysoqCtUW66PAcz4eunuBaD6TP2kkjTmYkXqBMw-a0dsMdq_NPQxII0hrp_Ch2ORaHxlRusC7tqCJj9ZvjLutGhFerzYvD2ItD6Biq9yNGUjcY15YoiJY_hastzfG5ieqeOqIMqwRiNbwVxHfQG3mMsa-g_V4&sig=Cg0ArKJSzA7VJq-MSRJCEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=71&vt=11&dtpt=69&dett=2&cstd=0&cisv=r20230426.40507&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sun, 30 Apr 2023 15:15:25 GMT

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 5A85 656 B
702 B 233ms
30ms Script
text/javascript 34.149.12.213
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_978756687882&jsTagObjCallback=__tagObject_callback_978756687882&num=6&ctx=15911784&cmp=203336&plc=7322076&sid=18330&advid=&adsrv=&unit=970x250&isdvvid=&uid=978756687882&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.40&dvpx_strhd=0.40&brid=3&brver=112&bridua=3&dup=null&srcurlD=0&ssl=1&refD=1&htmlmsging=1&tstype=128&m1=13&noc=4&fcifrms=26&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=165&eparams=DC4FC%3Dl9EEADTbpTauTau62C%3F%3E6%5D4%3DF3TauU2%3F4r92%3A%3Fl9EEADTbpTauTau62C%3F%3E6%5D4%3DF3Tar9EEADTbpTauTauc5eh67454a4hhd__2g%60a344d44434234%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&dvp_exetime=6.90&callbackName=__verify_callback_978756687882
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.12.213 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 213.12.149.34.bc.googleusercontent.com
Software: /
Resource Hash: 63c3ea6220254cd3c792d66792f9adda0dcfdf60849c4cb0af767b87ea421f2f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:25 GMT
Content-Encoding: br
X-DV-Response: 1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 04/29/2023 15:15:25

GET
DATA 200
OK truncated
/ Frame 8B82 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e559f6ce402ca1a83c5706d906d50ff66412da59820809195d4c3fc6cd4fe24f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js Show response
pagead2.googlesyndication.com/bg/ Frame 9020 36 KB
14 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 09:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14118
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Apr 2024 09:57:47 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 9D71 0
12 B 38ms
38ms Image
text/plain 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?QJufug
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:25 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8184 22 KB
8 KB 39ms
38ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 9820
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 12:31:45 GMT
expires: Mon, 29 Apr 2024 12:31:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 806E 22 KB
8 KB 39ms
38ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 9820
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 30 Apr 2023 12:31:45 GMT
expires: Mon, 29 Apr 2024 12:31:45 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 mraid.js Show response
s1.adform.net/banners/scripts/mobile/ Frame 1BBA 27 KB
12 KB 26ms
26ms Script
application/javascript 37.157.2.247
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/mobile/mraid.js?1678702576204
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/Banners/Elements/Files/2087214/12601399/main/mraid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.247 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 5d18193691964b10a7e68b0e3332053e4d4bb8c7971559815345697fa5fb1a04

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sun, 30 Apr 2023 15:15:20 GMT
content-encoding: gzip
last-modified: Mon, 13 Mar 2023 10:30:59 GMT
server: nginx
x-amz-request-id: tx00000df9e5566297b98fe-00640efb98-32957437-default
etag: W/"7a1987ed3c4f4b044c9fa59087a230ca"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 /
track.adform.net/mobile/csimpr/ Frame 505F 35 B
519 B 26ms
26ms Image
image/gif 37.157.5.132
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.adform.net/mobile/csimpr/?CC=1&bn=63115208;msrc=1;smid=0;idata=752oSnrpakGrpKj66K3WYMHzWJ8iG5IJZk2TgBF5oEiNy-7h7Mj3NyxTCoTi59P713QwLtPiwkfwlXCTWTZgCsWjAexNyLOV0;;rotseqno=1;srctype=5;set=en-US%7Cen-US%7C1600X1200%7C0%7C300%7C250%7C24%7C1%7C3%7C7%7C1%7C;ord=193980545;unloadid=4679750357553108070;mloc=https%3A%2F%2Fearnme.club

Requested by

Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.132 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
content-type: image/gif
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
expires: -1

GET
H3 200 C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js Show response
pagead2.googlesyndication.com/bg/ Frame 8184 36 KB
14 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 09:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14118
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Apr 2024 09:57:47 GMT

GET
H3 200 C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js Show response
pagead2.googlesyndication.com/bg/ Frame 806E 36 KB
14 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/C5FABZFhf_ksn8c3oRsp46guIkA5h7KYEUMuG3ADcek.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 09:57:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191858
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14118
x-xss-protection: 0
last-modified: Tue, 25 Apr 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 27 Apr 2024 09:57:47 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 7AA0 42 B
64 B 144ms
143ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstzRBhl8NIBvMrS_Ka7wxSeXODqGIOtSfIQY4lAsn4BREQK3Tz473LV6GvTxexyRI6QCCVE49M5LT3lhELd_rbIip-evxxXydeA079puRWPmVUPQoqM20qk0_CxC7SGskyfENodWUlSbKa4FQbG0WIQnpU9ZKUGsftuXksuRw8E25dQEJbl_l-WOZ0zPeOE9Tach5AuqctOHeETBoUrcCX6D_EKDAdvn4a5ai44Jm7LC7hWeNoWNJdJx1YV4oojfXbUudQjqyJ9n-SXrx8Zj7wqP9hMWD1oIHYdsvUGXe1NME_spJ8z4B-Zj1813ZpzplxFDtw93u_vOqmO_eucCq5ApIR86q4vj1PdrAIWzlkU7SoGGyVPGxQaqI3CLbrxDVeLhh_9sTyaNTqGIuPu-GS19xVGAyHh4S3Zzg-WLmo97Dlv8n-y2d0i9qXSNEy8CWirtloqMMeU5R4aiizi7fmIiZcYD9xzd74BsrrucyVmbdX6L1KF4M_E1dwQEyaSo3LNuHaC8lBBZSPqSHcr-bmDB29_xgSitoasnbrsuJEjUwG7Ss11FeQEITSOqDEjnOtZAgVL80puoeuIqxXN9s-xbyf1IV61VZjy-JnwWBHn_ZEVb0FansxgG6nizBy0bYWUP6E2Lk5crpShcp-DUw88fAEtNLiXNYkPjigsfF-IM8BNViK-2ShpGTY1Pi1RmqRvJUyDS4su5ZnDYKcRx3XXR3jyxh0Q1nl0fHowDpNHt-unv9tyyRfSAWs7B71Wr1w_qjnT39bvt5Tv6xBBwvkMc-ssPaqy66Gmb5e-xnALU4ZjTtDwmrmrvk0dPyC5p8Qo0s4pCvRofMI1lQFRWSNsvxc-RqtnY8Sndt8ZpQeXr7YVOSZOoQWZ3h3Uwx6MvrHa2jW6CT9Wi7-mSohUfwphReOQlyXFdjZP4uQjx70FUgLxwZ9fQL5Z2AN_C2BRc6bI1xeMMsF1avVfr2SWmRag3yRKSOGdGIIJ3nLGYvqzwWZA-cxhgvNm5j28H7CLWiPpcB7d1B52topvZNPzEK2YzR_4UA&sai=AMfl-YRhKcIYVkdQvy6NGPgkEnhblecg33aO1-KX5DMAZLGGeOP3YqZoHPbn9JEelsyNOdAqu3dAEdjdZBtT_8tpLF0cBv_FujcDe5A49PVj0gUtN1CLgSPcPwmlVPqf0F-B3TAm_7-RF7twP_npuLMxrl7bsb4XPD5jxw&sig=Cg0ArKJSzLwVr2xj9QlgEAE&cid=CAQSSwBygQiD3A2puVyASm4OPBs6G-yMS2CkvkHxcsa1fNKXfuG4C6bg5QimyavcsgpNVs5ISjgfzBfJ_ueJKzA2jjl4jkQq_iIvC6yjghgB&id=ampim&o=315,1110&d=970,90&ss=1600,1200&bs=1600,1200&mcvt=1052&mtos=0,0,1052,1052,1052&tos=0,0,1052,0,0&tfs=1199&tls=2251&g=100&h=100&tt=2251&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 9E0B 42 B
64 B 142ms
142ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstDsz0OXb_fA9qbljqzWFF-NSb66SS69ovNP89R0cKsn_HECA-LK4Zbe7SNaNM6TgFc5Qb55DOHyL07CPZH9nrWghF2mmtfmTzFTAcCCheMANZcyetta6s00p2zL-uKL_eRTdOE7A&sai=AMfl-YQ1Y5bmkL6gTU3SQpYU4SJRAJPG658K6nMoVDAU3nkRzmN10Gp5tM-QsuI9QARFeWa-ZruUYJyjkrTM_2a-WtqZQo9OX3I5cSg_cId2jig0aRz2MqdsTDEKN4IRR3KdM6alJ2UujIfaZk9u&sig=Cg0ArKJSzPUt79sV4m4XEAE&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&id=ampim&o=323,158&d=954,250&ss=1600,1200&bs=1600,1200&mcvt=1054&mtos=0,0,0,1054,1054&tos=0,0,0,1054,0&tfs=1102&tls=2156&g=100&h=100&tt=2156&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content bsevent.gif
rtbc-eu3.doubleverify.com/ Frame 5A85 0
234 B 64ms
26ms Ping
text/plain 34.149.12.213
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtbc-eu3.doubleverify.com/bsevent.gif?flvr=0&impid=b8cb8e28904a447c86477c86018181f1&vfdur=234&cbust=1682867725807328
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal117.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.12.213 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 213.12.149.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Pragma: no-cache
Date: Sun, 30 Apr 2023 15:15:25 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: 04/29/2023 15:15:25

GET
H2 200 globalpassback_970x250.gif
cdn.besafe.global/ Frame 5A85 37 KB
37 KB 95ms
8ms Image
image/gif 2600:9000:2240:9200:8:455e:4a00:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.besafe.global/globalpassback_970x250.gif
Requested by: Host: 4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
URL: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2240:9200:8:455e:4a00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 496ed7d3eb868f74065c9c4f435b0d4afee4a9f37bc4934e7fbccffeff98d3cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 20:00:09 GMT
via: 1.1 fd4a8fa7c304171992e7f22fc8894904.cloudfront.net (CloudFront)
last-modified: Fri, 15 Jul 2022 20:03:13 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 69317
etag: "9bb76ce5aa5d929a4f69f37b75f469f1"
x-amz-meta-sha256: 496ed7d3eb868f74065c9c4f435b0d4afee4a9f37bc4934e7fbccffeff98d3cf
content-type: image/gif
x-cache: Hit from cloudfront
accept-ranges: bytes
content-length: 37581
x-amz-cf-id: j12NJV3lS8OIpn9chxbxS_BELrMlwxQsOOcw7BnRz8O5uZdpbfgm1g==
x-amz-meta-s3b-last-modified: 20220630T185152Z

GET
DATA 200
OK truncated
/ Frame 5A85 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 58ea64949b103462e43fb71d33f6316dd0755d4a7ce20eb13bbab9f94f3d4c82

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200 cm
tra.neodatagroup.com/ Frame 960E 1 B
2 KB 29ms
28ms Image
image/gif 20.101.38.191
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tra.neodatagroup.com/cm?sid=1&pv=MEDIAMATH&eid=3069644e-860c-4b00-9b14-7db1a0fa86b9&rt=img&rnd=1324546367370
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.101.38.191 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pixel.mathtag.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Sun, 30 Apr 2023 15:15:26 GMT
Content-Type: image/gif;charset=UTF-8
Connection: keep-alive
Content-Length: 1
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"; policyref="/ad/w3c/p3p.xml"

GET
H/1.1 200
OK img
pixel.mathtag.com/misc/ Frame 960E 43 B
528 B 24ms
24ms Image
image/gif 88.221.168.207
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/misc/img?mop_seq=1:1&mt_cb=808086&check=3069644e-860c-4b00-9b14-7db1a0fa86b9&mop_top=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.221.168.207 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a88-221-168-207.deploy.static.akamaitechnologies.com
Software: MT3 830 785530e master cdg-pixel-x26 config_version:"unknown" /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pixel.mathtag.com/sync/iframe?mt_uuid=3069644e-860c-4b00-9b14-7db1a0fa86b9&no_iframe=1&exsync=https%3A%2F%2Ftra.neodatagroup.com%2Fcm%3Fsid%3D1%26pv%3DMEDIAMATH%26eid%3D%5BMM_UUID%5D%26rt%3Dimg%26rnd%3D1324546367370&mt_exid=10082&source=mathtag
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date: Sun, 30 Apr 2023 15:15:26 GMT
Server: MT3 830 785530e master cdg-pixel-x26 config_version:"unknown"
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Content-Type: image/gif
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 43
Expires: Sun, 30 Apr 2023 15:15:25 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 1EF0 42 B
64 B 144ms
144ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstWhnUDs3zrSOGi3UnuackzveYJhWM4hCWaKKXsZ80lLC7urwo7ww527ym_FsgCgE_8ITMP_McyCaWcmUnypm5YNiUaIL8RsUrSThbJNEn-FlL90ubDw4BWHQ_WbKSlXUWlN2EAEW391gTum5pCCVPNhrX0poKfj4_KfhTZLjn5_bNkJzTLzBb6dijE_iipjNQTXN9MJedmLhWyHJsn1i9_6cj8GUra6fdRUY-1QCP5qKLJWfHHF2sSZWTfysdw88MftBVhnG83wHxkpt2VVqMuc7eqIrj253htXTZNd5JUgflSP1dnqapLu-TwPCCu3Ea6yx5YflMECyQqFlQB6yazTttja3p-IdQy-GB6e70g2LswzabOR03VD4dGrd_PnzJYdkq-WSwVPogaa9qS2bt3kPgdTyl6EJpyKvLY4qExrp7E0yAdh90aSxGgz_Hxfq-vAn0kLmbFDaCMHzxFuqWC90fSF9dkbelMREKRGIT7VwZfOcinifcO9R6AuuNhtfpSPt3lUDVT7vQlNueSndtVgEVXBYApPAQjGH-9Vv2JbntwbSJkxj3JVW14xblkHJn--nPM-j9QaK0a2YWosCqslIrgq1AY7obkbjviwphQqT4XLbGuFeFeIJ3RNyt01DAZz7zmQbRRacTcPdnL2uqq1HZmG0USJ3yonFneG4cxPcw-_Innfqgt_xS9W2cyuicDQPouI3EcPbbhDnwRNo3HO5sJeK01-Sdx5tW06VHKx4S8TU1MwtCKP_bsQQPAyLixBs9M_JnNz4ioXDZMYlP7sdkftu-MOVT_0gt93Dqf1v3kl39vj5AAMPhRldVYni5ehk_Y-bZCa5CUjUL0NfdydhORVMtqtUgJiK2_DyhSg0ZZ0YEWnc4v0aFTO9wtqasg4r5rFyk4Igv5OblMdCAFoQb5BKl0zNQa4VRJMOog_pKFYSLFtTI2tMGcat4TuPukQm-zvJ2V3tdp1ny3kDPE995hA1gVUfnKHlIwvnsQPkeIgeBOX2pnzEV_S4j2LbnId3KuukLPAFPXiHO3eJJCg9yPZ1vS7A&sai=AMfl-YRinDj7dJazgt4eMhl1asfUoy0RruekVy91YVncwy5MeQY8c2H--6FY-jTDa7pTiYa_xCHmbqIaf3wJh9ZjB-BLjqQGCZXGCoyLKB-f6Gw6UWdIanCe-VESV3Nk1C4Vv1C7Br-0yEdNDNrCPLlZUEpiejOtXMfhAg&sig=Cg0ArKJSzABXaLxIii48EAE&cid=CAQSSwBygQiDyCcIwmLtKGR5MlFvve8fk5us7HyOD5LspbzJx5R8tqkFy9uwY5712hgZ24WxwSisGFmZPkdpazXUbcPugzxltp1SGNVowRgB&id=ampim&o=977,514&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1096&mtos=0,0,1096,1096,1096&tos=0,0,1096,0,0&tfs=907&tls=2003&g=100&h=100&tt=2003&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 822F 42 B
174 B 144ms
144ms Fetch
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssrlTRKa7r44iJkNMgcj4iDx9M_wKaDshl3C6reMW8GNKtQLlEXtlFdDAANqScJrg4fvEn1FohqEagWDE578eF9H43AgaG2M_ebR5sD1ab5bCqhJKPGt-ulfo1spwrC7N7TK6wbJA&sai=AMfl-YSRwQPX7TIo_9yzwLx0YziQs85u1pEXKKrtjl_b5HGEHrMxGBvRMF6uSD6sl8_enDPNXSszStWoy6PeuYpDTWgYBVNsfvKHTmM0BncK9GnB5wuVKqNfG0Rnr0Ma0uSPNl0-JUW6b2CQSYh5&sig=Cg0ArKJSzMP5VkPzS_M2EAE&cid=CAQSSwBygQiDrVd0jK6akP_qy_fkdmA0L2XbA7eNRLIWvu7rXiyDS4_SyFYSnQdTjwi_PvlhQiy0uJoIp99rduLQSIWjqAG-cBqIS6rSaxgB&id=lidar2&mcvt=1045&p=0,0,90,728&mtos=1045,1045,1045,1045,1045&tos=1045,0,0,0,0&v=20230426&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3490001028&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1682867723987&rpt=1113&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E108 0
20 B 142ms
141ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BfYm7DIZOZOOhGqvD7_UP3ceUkA0AAAAAOAHgBAI&bg=!i4iliNzNAAb9Sbh13Uk7ADkAdvg8WmQaTM792PDdGn5Tkn-wJbhyQnV0Jz7j-jnbZKhC7dG8-42TOjYYX5lIaEz3ZyusnyvzrEsCAAACaFIAAAAEaAEHmQMdioMLVbMYoAi6Vg8pyTHlQdPLuzEieZEcDpqTBAPJr0NGXwJG61mtPN8afEvRUXKZdoA_6ZUWfa5kFBO6GRwWBsW4pr-muuTTU4cTKAJtDBUmdg3gM3jp1JkuO5fCVhIjrBvCAb5oPwzpf6pHVvcJDuk3lEB3e5XPhXUT3GndnYSAnkpI6ugcr1abJjm1RigMTAnSDfIODAuhJ1ui6OljBRjYclZ1lpsonFITHYd1RWbWdj-l0RirS0prwluPxp_dNsXybuGDBle9wz4tEtg7k-by_rFmLhtpu-td0Qb_9ONskfYK6PCpSzOiU-7vgPGgjmbddt3680RsN8rG3G1XS7yRqvWKh7xZEuJMBJPGSEZGXv_8m6I-ghQctK58t0n61QtZCc0ksKS5of8hw1CasGim06I1elsWEqX2Xd1XWREVSYgAOfsIGsVM20PvREUXwVr_nNv35HRookBpwUINKwaliR1cmh_xkKiELS7DDqHWGsYBCzNNg2TXiZJZNevVNtZ0n4e6p2pUaggLNpMLaB4NspGt3yWpBRwgv_tmo4LM6lozSSrETkD9UcKirCqTN8f2fFUdiMjCCy_Ba_loJnLSNK_VxiR-KB8R0VoY4jEmj_39A8vXdnn0JIc1NmK6hOc_TGHQC3Hk00wX-l_0Wsn_fg-cGoNN4AHy0O9KlVE5cbehuSRasFbuOab2Nb9Te5JOzydwOaRk4vURK2I235KM-Qw9r86ws0FOC2yO3XAIeWhCs1BSAgyPYo_kidMyJuDUqS-fJgYgoTCaF3bcU9n2-YHu4NOZCk7asNnkIc_kjku7gSYv3O4ShJWirlTWdXwUBo5AuGvMDzWTuMRBzq8AZFRExXFLu6OcPskqN9fjBGRsErl7ukxVq5AJCXMN-OJCzGgbDBufPE0fqQXRHjkmoirJTwk9yCmpLWhE8XbytRyeKW1TATLsOXHSKnq8HYvH6WZQj2noOeTRxXhv7Xk4Plb1yO9rNYzNaJKU8mR7y5841qAkMIUi1wEMsBCZ_P8sXwvK3EJ7zyde7pUGP0NkHlMVkukEYTM1Rwk

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 142ms
141ms Image
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202304250101&jk=1792785991261384&bg=!KSqlKn7NAAb9Sbh13Uk7ADkAdvg8WnlcM76rHtZap8EkYMV0MLO6Cykl4XzXKakHEaJYOlSpyRifLMnv2f9O2-tvEbNcrM8_lFkCAAABnVIAAAAEaAEHmQLVkwvR6pal30Mjeu4bqs7CZ-5irslzHu4gjJQ8HXMBCc59Wg2oAAO0m0L8j62QBm0kNu9cvErfPDNWPGN10H9lNeJRblLig5IqeypmjnJ8Ic5EVyITKDP_06shgG7m_Ha6htBxH9mta4QTOicp9F-h7YLoB2zMnXXEMF5fis5VRFCg0RBwokKViSMxi7o2WqdMrmJMR3bhXjeo3MCLs_qkJJrvyn-BigOe8sH-JORl207yrY9MfdeKth_TgpLteqKWdQnK-TWnTBnUkpuaUVFk09njS4nkLIgksftBmfRZjZTbWSQeiv1D_bnW0lMObbCmcMVnb2_9_keqDsZiXz-2pz3nNviA5QkqgO6ZwQUBgYxWm7zc-JCH0qktTVE_rtJt00aoIKRMo6KmcQm-ZZtW3eIe1zcoxlEEEo0JowdL_nsplNKfN8OPI5BjggxXdwBIc75GiuLlH1j8jx6IMCmo9_StjbHLqNFJzGirL8A0Pr6msZkzb1XMl7E1yM5ksUvAkFfdzFDCFTaf7siUW15jfZZ1a_o8BprG2KHNs2LXNuq1ZzzQdXouSqLyQxWJFvc6aJAVYC7evaGZLO4ymWP6MJHy8Lur2aicx4FndrilzFa6OfLDcKvaq4XmyOdqGd2DSjCwmOGGc-6zc95pICqdPfqfA17MXursX_OPxwrWfGtIt_D_HwYoM1zEYCbH0GwVGi3xI5A4t6Lbv9KjXBPKXDlPQgETUKQh10Na7BwdV6uhsBNTlIKjo5vvGOVsnSb1oaPPEylea_ytLbGJiKL7k2PsGiBuviuE0ne3ykLHhnkbCdDUs-uzAakkZP6aJ7jMBKYCm6PxuZ-9zJYNcjl9weaCHlHS8sxCQ_EjXRflycjj8q9a1sJZ5s_DAedln3-Is30pVBljri1AzEg9Q7E6hB0zQEmqXuT_lr6yuAANw-K4amSn6jAKBaAHi0rwO-CqiAUZoY4
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://earnme.club/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A2E7 0
20 B 142ms
142ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BYPj2DIZOZMiWI7mmx_AP9qaCqAMAAAAAOAHgBAI&bg=!GhmlGU3NAAb9Sbh13Uk7ADkAdvg8WjucBsmFQlCwxbju7-Gu-0_KmxJvkAOv7Zir2CjsRcccu4fYYbHZBObgm-SmQ2pJZ6-m1-kCAAACgVIAAAAEaAEHmQNmcC50_DLSPet0gxOvNUfhvg6MtRdliRewFipHBASMND6Db0ma06RnOji7AsyvsCdittIapaCxBBJcSQCiqGB0POX3wvLqcjKmXixizIxiv8fnPX71-NvvXjPT-G8NfB2Nl7dr0VrmLpJPX2ItN6o7SgV7XA7uFDrzl17Cn8vijbJDyaG0fBncn3d3VJe2DJykiOCBU1yqzsR8cYHZ92DLQd1zM0nnfxVW7MsCODAGA6qMJUdzT2X_HJPoIkku_JyMoTAJc_zLLKxnJxFGAov4yLQox9sJ73Uorm4WfRJeLk65GKXQgcC99ioVZOFykMFK2TpFeaHpLrNSRbgV6Q9x4IOIqjC_cZwJWvUjYpPlRc3mGHxH8KwZ7dkMBYmQrdeEDV9yv19diff7qjMjvoscIUAh6TXz4VjzpCreZ3Tkh_ypmphc9vQkE1q9oLGyi830mRJ-8B1VuSCI9NWWURqiof_NTa3t76Xk4YNcMUM0qUX6XiVUmn4G2yCwBx9kT7ts1emL4xJiq9kYVSMXgigoCZXar5xYml8geo3VnbdWXxJ4Hz3eqVdrhNpGYPRa2g-SCSufx08jEG8ygoxzV7k1vApaQTTC3wkfv5ElOY6hK7WGoOCXTxyq1-EhZIoR-XhIWbhu_09M0iuTdu9OPFoVxSuLVAIQafl02dvooQOopJ32SQbU3lQPPviyA4twP75uK91VVBUpw1KF-G1PDKfRj0KI09vMod1VbQoUP1CytMlnoHNe_NOyWma76_8WxlNc2tpVeNxGgsSwJLojYd_lzjYOOT2ctp04KRboDrihqk-wnZkwaox8u8vwRrxIS3o4C34kTsEVWcNIdI3ADMUbJ0UUyRDC5B86KR5bLjBlEu0WVOyO1tjmlW52bwO5Y00HzCOFm8sb-DKVjtuR2c9BuHYVoCjqKo97l-c85aTjGwekhr9CBtGThZoFi2QjuEv2mWOKC332oWpzrNqdyvjGmfRx2jN9svGqDkgzFo2k-BFFFYupv8NbPkNP_EyHVi0LSW0S6dPWdyuRhFWcl2MHiBxC92cseK3VT3MmJV-_5H5s_kzXcxSYq1dnel_LuGseq3l-oyHQOxk-uuTuNCsZTFJXsnrthdUwushhbKIbDcyYd7LJIQMgv58dW3fhIWAeMfpJHAgx

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9020 0
20 B 142ms
142ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bwdn6DIZOZNXVJLmmx_AP9qaCqAMAAAAAOAHgBAI&bg=!eXqlei7NAAb9Sbh13Uk7ADkAdvg8WgCrxDmUe_o-Fh1K3wF-EhbxfeyWqD-mU5Ef7zhthfqwpf7Att2Rfi1OqfeAYrC-CyYJRfUCAAACWVIAAAACaAEHCgAi4lDqlUdGVHpF4ueprcwl5mDVOpZyyfeZ6rqh0Lmwn2BYTZkDIIxUFXxnZNYmxk8VatJk4f0QtNyNN4EFDsSjJDj2m1_JqT5GCdsO2XQAJezioUKjiT49n1Btk5DOX-Wrk0obgS-T2YQX6RsT2gUZXaamqyIcRm7J6SXa0j2m3Vc6Yy3fQ9fngzfA0LTYWmbavWuffaa5P9yM0MvvEdQC9ppEXzzMtKlGTEvNUElvYng5MKHWupiK8LGDYUrkdvKxfn8rGq0tfcd0CIIPnMMqTr9xNCh875eIp_TH0EAWvPL0ziBA4Q5_b1HMsADIaFt9da30lE-fM18up6-0hcjX4Ta3DQgTl6cDMrro_udwU6W1Jf0NrG35oo711BQ7ZoQY4BLFY57HDlktE-dA5RSGeE9jJMiVDdwXbYno7pt-XJkYBM2Sy2rFkEjygwfpkimS-sbsIdlvo8EY4Ptx34UlXtY1WWYz1ZFWXJJ8n9tOPjYqS3zXjL8-KIMen9gICR-wjBR44UcDv9gtYUb14Xf701DEs2ManBklTaVWV-nm9B5mZPqEqKrQe2fG1OrP-AC0BorPZiVCDMNNxSFaCBFug5VgSu86hMGhkKUwKvalHg5JTOsBXq1BcgmQBjozuNupPhK-rD34iAhCOG3FSy4KN6HLvAXRAAGKT7bynNMjBOz_OIBvp0voYyeuteMLazZlfUtAmbcSIipBsVReO_51ntHIkBZ55FgJSbvqFvOlyxPU9IRfNFTSaRYHNZ3hZcPrs8t8UNJkho6ZyjR5nQ2rhXPhnSqrvGUxR-KaWbdDU4E1nILhwtlNm44Dy4TFwzKdcqyG9o30s4zzFP_SpFgN1Ao8nhpU0RAjBs9OQjpX58Vlqw9V5ycbKy2DITJMgVXNybkf5V_vLAg8oBKoEPgku6yc-xDMy4xQgqsS1uPY1QOIk8LtUA7GBFW4MVgiwigtggj-S-rgPKh8AuXfMiF-mAr27hgSu6B-NkwYGVbIpRHT66APVclAY1bwdt8ZFw7Mtfwm9y29iFFX3oEetH0LRwfQyjcY8utB7CpgTc3dyrsvb9Dl5qnmgQz0yq9gcab3l8gXAOXW_UKDTVt2hoToDBT3coqU

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8184 0
20 B 143ms
142ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZ76kDYZOZJydEfLbx_APsPi7sA8AAAAAOAHgBAI&bg=!eHuley_NAAb9Sbh13Uk7ADkAdvg8Wvju3tb-Hu-LRsCzxjslP30dBcC8--TwjYfTtbGCKlao1kJQrrR4qOl8Yf6uCuW1DRsSnYYCAAABgVIAAAADaAEHmQNBucb096TDlXarBP0iQUrBY02qdnXODtDGcWnXSaVzxvlSGMQy2tyQe5Uj5agAXa2X43_u74ILwzHX7B5Mta6mcZZmpfcx10cHRXlrSL4Z7aRzWMDygfJHGMSOblVyeEfIcY4iVhuZx_i82whhLvl43tVBpkuqQygr5dCKG5EoadYszQdiECvGlxGAcho9utf1uy_qzn36OgcLARAskLYiwwU3y6AJPLxgMXjlQkTDqzaVzO6y4RqYOPuWIca4Z6GobFUN-dBQhOvWbZEXjjSVMUMFII1Grvc-l-tHRiTQZiTivKKR2sGg66J6ip1UKa6unevsQS2lKC3Va_eEpH_h2ZNLUTzW0_y8QS5mwSQ3n3UVVpUL0NZsNJjphcj2AOB5-IoS6DXk11dbriaL2cLu2L6nCxdUZLuLgxhcMGQsiyJ5-ZO1qTyn5IE7r7ldSWepJ_YiUCXp81lZdyvt70DBa--wLROGlTMC5RXKVrZFxv2E57W8cmq_2XxMthTy2bPEX2S3Xrpj22LuxehmzbIUMbTD0uRs-mIo7Vlm-AULKW6uB_HLXYbbltQlYe_ZaCZRoeFutJ0rU9IkU0j5FapHCqDcNVhvpy1BwK2Y_Dqdp0zlFInGMJGd3GiCuEA4V9nqUNHv4dY5RVTxuxk5c2fcCwc8Ls0ew-w96lqxpYcrF7NFxvyCTmSIWK-54HkWiPCFbdXwJwxTgOXmIVvlxoC2UyR1DoLUQn0WJR4tfjTaAFDfcd27hFRMhhOpwDXBLp5r0MPGxIjmQrzEc1eejY9-YoD0RAmT2jfj5e4MaySNBr6B_ClqbBjzpIQ2R6GOmGej-LKjkS6zQQbTu2t0zsdyiNQO4YKajvFeeTLH_YhnRiHfRxUn71bssfLSj_VVICc93mW0Vnaf1KXSPPMo0D_314WcbwbTU57nux4oXn4x9xIY7KJBGOZs0jR8-Wf0CveTc2jS7jROJ_qsm27Cy4OGwml84M6hbLm2c5qwZyO51dwqcPZj7kkotloHJUaJv0EYXVCD8-kqF4h_LVk2v15cbDup_Vn5dg61q2mP7-ghUeDc5pnNz9CipBLXhX05T99fdvFt1kntpJFCyyNFTMLkitU

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 806E 0
20 B 143ms
143ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BMnIVDYZOZIHpE5v13wOm_Zr4DQAAAAA4AeAEAg&bg=!qqmlqf3NAAb9Sbh13Uk7ADkAdvg8Wqo3gvFsWCXZrEV0dwC_DqX4CO9SSAHVqiLpfYL_DkJmDwrffRsvrtjhdp91rF9l6RCsFLMCAAABblIAAAADaAEHCgALxS7Mwf72N3epO9OZA030VOvWnZJkBGBeyP834u0vwGXjOImNfU2KdtibuS-awFAI6b12mEqJ-JZN4V1i-gVcWVWcVuW1_-tKIpP7jNZRGSkneyFX8VVQ2Iyc5Sk-efaxiHD2O0tiw5hf0RPA9JREePNC2akr2GPMxGfwFn1vTTvlkat4a64KvABtoubBNTEm39PiY8cHD4M4b70Q3xMcdgzFsfTJdvIiCcHm3atev0bfEKV46jrQL5xElk_1BrCtztWqbcumPWvgB7dErLXXcobXd6cNzu3ozjY75aQY4jnSb37pwXsuZrnuH3kxO9dEP9CBAjLf44GnbYJzDdeyY9Zkh0Iaho0jeedkjYp5thm31FgBaKStS29NvZO1k8QakHyPcTJ-LUxPbbFkdQj-zXPwZ2MDqIjXPN8DXWZGZRXnCH8ljUeta2dn1WLIVmoC3J2ncR-bTuF0pkSgNpsGaBrP8hgyqe7gQIz0oNXingV3ZLbJCrV-svHQffCYRRq9HB16s_JzAQcCa3ALkz2rFvDCmQlqeNuYbWDnGLqVzM2xUVe1Jejh-VArtS7DAcyW1WD8W2lOmlCMAo8kbZOZ49f0nQRP0O0upwQBEbvoqoSWRzh6Goow8ls2GnlmfNc07WXdWJU5zRodufdsdjJmXFi8mvrPpDF-Cp8y1aN6ECwisdtvS0nNsyKWM_YP4ZVy4QzYayu3B_y1oQ-ZuFpC9L7HCtJ0KWiksGabchNOAa8JdzRsWlIG7nf8jUSJ4ww_cd0j6DxZSWHoZ01zag1gjWaIVO4TjXAmUNz2hMSnuOWOvDVM5Qv2_mLAFV2e6Ku5VHN0_5MAZluWogoHMzCnWzp4oiFdK7iBxplxu-F92szkiYam3nhnCr8K6_ZCtrzMWzNT9uxCPmI1KG416trBI82_tmQa5NlSQBQF8f8lxEYljylv8S3ZflZap4-C6l5GTyRelcEFe787KlFRypt4a3jRGLR5OLw-j6Fr5xFRSZGF4CWm8DZTtLmWvcHczUd8Th21V312Tu1sexNlbQg46HKgAJ1bF5iqTwd3h-ZJa6ExmUCkEssCD4pY3lWjYEAr3JYSfHR0qTtmEWAqqpnTIsNbxtgBuDEWVrCQm_BV9szRYEX1ftBc4zhWnQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 822F 0
20 B 137ms
137ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2643281638827&version=m202301230201&ct=76&x=1&cor=1578542443098544600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5627 0
20 B 137ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=582803101358&version=m202301230201&ct=76&x=1&cor=18180370243886703000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8B82 0
20 B 137ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2864990614516&version=m202301230201&ct=76&x=1&cor=5815852324295181000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 505F 0
20 B 137ms
136ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2717992346735&version=m202301230201&ct=77&x=1&cor=3284911444714765000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A85 0
20 B 138ms
137ms Ping
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8857569586127&version=m202301230201&ct=77&x=1&cor=9262389176477379000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5A85 42 B
64 B 144ms
143ms Fetch
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsslO9BBqt_lLy0Ws2lbjcmU1Rzsev5TnAzX1pJc-0ru9mvcRl2l5qv2ntsj1FNUUSRZrWLy_U23mVLEe4-EbgRSoE6uKkcrOOFRzanDr_jaqOLCZaCo-hoWj0L4&sai=AMfl-YRAjtCUpRKH1KQmWPQ_p6VMlgkda-FCejBLtnB54ou7KN9wrHAr2OyiXrFUdYUzIShqpmuO-TcTG7bEAJQczS5C9Wn7SuFfOJiKaqyGvGaxDeOXWUDwVyozHTEVU7jWD-dDlYyVK8zXAYNc&sig=Cg0ArKJSzMruaLO_OafiEAE&cid=CAQSSwBygQiDPl7sx6xY7gUI_8XZkQxS-8eD3S2r1HOzene8fbjkfosBY9TKqxF_J_BEBNWzHFZeHbrRUd5k_5SfSGDEEjzJziF8kqQp6hgB&id=lidar2&mcvt=1001&p=0,323,254,1293&mtos=0,1001,1001,1001,1001&tos=0,1001,0,0,0&v=20230426&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&app=0&itpl=20&adk=1276275020&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1682867724775&rpt=1251&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
54 B 18ms
17ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-LY1N2M6E7Y&gtm=45je34q0&_p=2092124212&cid=143068231.1682867723&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&sid=1682867722&sct=1&seg=1&dl=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F&dt=NORD%20N1%20from%20ONEPLUS%20%E2%80%93%20Tech%20News&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LY1N2M6E7Y
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:27 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://earnme.club
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track
track1.aniview.com/ Frame 4224 0
120 B 104ms
104ms Ping
text/plain 54.159.46.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://track1.aniview.com/track?d=Chrome&cou=DE&cos=Windows&r=earnme.club&rs=earnme.club&sid=29551&t=1682867723&cip=185.213.155.187&sn=&tgt=0&osv=10&bv=112.0&brn=Chrome&wi=640&he=361&app=&AV_PUBLISHERID=62176a72a06fe80ba569d18f&test=&d64=b062ea8a6e5f4ef947293d8f2c1f8df9&d63=b062ea8a6e5f4ef947293d8f2c1f8df9&aafaid=&proto=https&uid=1682867723468-986875175828-001215-002-009118&cha=0.7&stagid=62790805abc41c4450002684&stplid=6278f4f0a7dd573d85421cad&d35=&d36=6.2.93&cb=42668093820&d39=&d65=&d66=&d73=&apppkg=&d9=1000&d37=realtime&pt=2&cmid=&cwid=&cvid=&AV_WIDTH=640&AV_HEIGHT=361
Requested by: Host: player.aniview.com
URL: https://player.aniview.com/script/6.1/AVmanager.js?v=1.0&type=s&pid=62176a72a06fe80ba569d18f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.159.46.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-159-46-45.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://earnme.club/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Sun, 30 Apr 2023 15:15:28 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0

POST
H2 200 /
track.adform.net/serving/unload/ Frame 1BBA 35 B
625 B 26ms
26ms Ping
image/gif 37.157.5.132
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&msrc=1&unload=0@@63115208,4679750357553108070,0|0|0|0|0|0|0|0|0||0|1|||||1|0|0|k-Flh3hD9NpcPlakbYq96WbZjPvjr1E95B3da2rinFyORJGc_S6yi_L_QlhaeLlf0|||11||

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/banners/scripts/mobile/adform.js?1669130898142

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.5.132 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 30 Apr 2023 15:15:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fid.agkn.com
URL: https://fid.agkn.com/f?apiKey=2037571623&i6=2a03:1b20:6:f011::6e&r=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity/envelope?pid=1323

Verdicts & Comments Add Verdict or Comment

355 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
earnme.club/	1970-01-20 20:13:23	Name: _uc_referrer Value: direct
earnme.club/	1970-01-20 12:10:59	Name: _pbjs_userid_consent_data Value: 3524755945110770
.adnxs.com/	1970-01-20 13:37:23	Name: icu Value: ChgI3uM8EAoYASABKAEwioy6ogY4AUABSAEQioy6ogYYAA..
.adnxs.com/	1970-01-20 13:37:23	Name: uuid2 Value: 1876879530974592077
.rubiconproject.com/	1970-01-20 20:13:23	Name: khaos Value: LH3JZP80-28-3HFX
.rubiconproject.com/	1970-01-20 20:13:23	Name: audit Value: 1\|naVuGyos1qp8AkdpNnHOij5APvdogVCbaTd6KyMQnau+SmvwaNDOnuNtDeTNQibYT0XZRSL7Xhq7N1XQbIqEyNp8FH0KG6PuUN+/nvRkaHE=
.earnme.club/	1970-01-20 21:03:47	Name: _ga_LY1N2M6E7Y Value: GS1.1.1682867722.1.1.1682867722.0.0.0
p2.gcprivacy.com/	1970-01-20 13:37:23	Name: gcid Value: ed475efa-b15a-4d68-8f47-94683c5cb023
earnme.club/	1970-01-20 11:27:51	Name: _lr_retry_request Value: true
earnme.club/	1970-01-20 12:10:59	Name: _lr_env_src_ats Value: false
earnme.club/	1970-01-20 13:37:23	Name: gcid_first Value: ed475efa-b15a-4d68-8f47-94683c5cb023
.quantserve.com/	1970-01-20 20:58:02	Name: mc Value: 644e860b-1f1ef-9c56d-e6cf8
.earnme.club/	1970-01-20 20:52:16	Name: __qca Value: P0-116003151-1682867722977
.earnme.club/	1970-01-20 21:03:47	Name: _ga Value: GA1.2.143068231.1682867723
.earnme.club/	1970-01-20 11:29:14	Name: _gid Value: GA1.2.2104173016.1682867723
.earnme.club/	1970-01-20 11:27:47	Name: _gat_gtag_UA_249368521_35 Value: 1
.liadm.com/	1970-01-20 21:03:47	Name: lidid Value: ba5dda9c-dbb0-4c0b-964c-a89b0007ab8a
earnme.club/	1970-01-20 11:29:14	Name: pbjs_li_nonid Value: %7B%22nonId%22%3A%2223zga1W82XCFEiLtEfP_WZWRIB4L7RbhNwJd5w%22%7D
.aniview.com/	1970-01-20 11:56:35	Name: aniC Value:
.doubleclick.net/	1970-01-20 20:49:23	Name: IDE Value: AHWqTUnRyRIPxG1Cos0xOipC5sHoyUMNqlL_yxcXkAYQMyWs6Si5YWJltX0NDzi45nQ
.openx.net/	1970-01-20 20:13:23	Name: i Value: 8e0ca494-c302-4b82-a0b1-f9a48d4d9613\|1682867723
.adform.net/	1970-01-20 12:10:59	Name: C Value: 1
.criteo.com/	1970-01-20 20:49:23	Name: uid Value: ec6d70e7-1731-4d8c-81a9-f11411758ee2
.mathtag.com/	1970-01-20 20:53:42	Name: uuid Value: 3069644e-860c-4b00-9b14-7db1a0fa86b9
.neodatagroup.com/	1970-01-20 11:49:23	Name: cProfile Value: AQMPpXc/kAXdAAAAAAAEAAABh+dVD8gAB2RlZmF1bHQ=
.yahoo.com/	1970-01-20 20:13:45	Name: A3 Value: d=AQABBAyGTmQCEBDbHZSkxM999A9IxZg8X1gFEv__AP8AAAAAAOANyiMAAAAAgA&S=AQAAAtkWcgnaGB6c33Uau4O58ks
.neodatagroup.com/	1970-01-20 20:13:23	Name: cP Value: AV0DD6V3P5AF3QAAAAABq/mz
.casalemedia.com/	1970-01-20 20:13:23	Name: CMID Value: ZE6GDJ-Pi64HlRl2nlTPeAAA
.casalemedia.com/	1970-01-20 13:37:23	Name: CMPS Value: 1130
.casalemedia.com/	1970-01-20 13:37:23	Name: CMPRO Value: 1130
.neodatagroup.com/	1970-01-20 20:13:23	Name: cOptout Value: 0\|yocToken:DkuKCTVT5dXo9sTVnMX_MGocaxg
.doubleclick.net/	1970-01-20 11:27:51	Name: DSID Value: NO_DATA
.earnme.club/	1970-01-20 20:49:23	Name: __gads Value: ID=08d132c6ef3a36ab:T=1682867722:S=ALNI_Mb2dpU-zgy7kAnTT1NHMd8g7cG98g
.earnme.club/	1970-01-20 20:49:23	Name: __gpi Value: UID=00000c0dee72ecf6:T=1682867722:RT=1682867722:S=ALNI_Mait2cu4qIwFSpwnltIYZmf56eMhQ
.adnxs.com/	1970-01-20 13:37:23	Name: anj Value: dTM7k!M41.D>6NRF']wIg2C$Iel:t7!]tbPl1M>e)ZlrFUfJ+tGXxoTL@K9qQmSL_BJ?_bM'p'YCFtd5`Ur]:^!r1B%nugO%v4VB%nn(O)ySEJ
.mathtag.com/	1970-01-20 12:10:59	Name: mt_misc Value: mt_bt:1
.mathtag.com/	1970-01-20 12:10:59	Name: mt_mop Value:
.adform.net/	1970-01-20 12:54:11	Name: uid Value: 1956117833796772263
.adform.net/	1970-01-20 11:37:52	Name: TPC Value: 1682867725171
.earnme.club/	1970-01-20 20:49:23	Name: cto_bundle Value: XH93ll8yZ3VLb3RvRUd5MHJpNiUyQmsxZTVQRGNsWiUyRnI2JTJCU3RSdTB6TUZyNmhYaGpTTm9PRG5XM29tS0R4JTJCa0pLYVhBOWpqcUY1dkZIJTJCbHFORFJ6bk5tJTJGQWdVWjgzZzhqV2dGOGVSWHhLQ1AxUFVqU3R2U2w1Q3Q0d0NIOGhSNGF3djltWWhmdkZFTG5JZTFVQ2REJTJCYjI5S3ZTdyUzRCUzRA
.neodatagroup.com/	1970-01-20 20:13:23	Name: tr Value: loCAwIKjQVBOzmRP14ypTUVESUFNQVRIzmRP146AgtoAIzMwZmE1NzczZjkwMDVkZF8xODc2ODc5NTMwOTc0NTkyMDc3zmROhgzaADQzMGZhNTc3M2Y5MDA1ZGRfMzA2OTY0NGUtODYwYy00YjAwLTliMTQtN2RiMWEwZmE4NmI5zmROhg4=

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://earnme.club/nord-n1-from-oneplus/ Message: Access to XMLHttpRequest at 'https://fid.agkn.com/f?apiKey=2037571623&i6=2a03:1b20:6:f011::6e&r=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F' from origin 'https://earnme.club' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
network	error	URL: https://fid.agkn.com/f?apiKey=2037571623&i6=2a03:1b20:6:f011::6e&r=https%3A%2F%2Fearnme.club%2Fnord-n1-from-oneplus%2F Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://earnme.club/nord-n1-from-oneplus/ Message: Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity/envelope?pid=1323' from origin 'https://earnme.club' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.rlcdn.com/api/identity/envelope?pid=1323 Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4d69efcdc2c99500a812bcc5cccbcabc.safeframe.googlesyndication.com
a.ad.gt
aax.amazon-adsystem.com
ad.doubleclick.net
adncdnend.azureedge.net
ads.pubmatic.com
adservice.google.com
adservice.google.de
api.rlcdn.com
at.teads.tv
bcp.crwdcntrl.net
bidder.criteo.com
c.amazon-adsystem.com
c.neodatagroup.com
cat2.hbwrapper.com
cdn.adapex.io
cdn.ampproject.org
cdn.besafe.global
cdn.confiant-integrations.net
cdn.doubleverify.com
cdn.flashtalking.com
cdn.hadronid.net
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.playstream.media
cdn.prod.uidapi.com
cloudflare.com
cm.g.doubleclick.net
cms.analytics.yahoo.com
digikulture-d.openx.net
dsum-sec.casalemedia.com
earnme.club
esp.rtbhouse.com
fastlane.rubiconproject.com
fid.agkn.com
fonts.googleapis.com
fonts.gstatic.com
go1.aniview.com
google-bidout-d.openx.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
grid.bidswitch.net
gum.criteo.com
htlb.casalemedia.com
ib.adnxs.com
id.crwdcntrl.net
id.hadron.ad.gt
id5-sync.com
idx.liadm.com
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
lexicon.33across.com
lh4.googleusercontent.com
match.adsrvr.org
mug.criteo.com
oa.openxcdn.net
oajs.openx.net
onetag-sys.com
p.gcprivacy.com
p2.gcprivacy.com
pagead2.googlesyndication.com
pixel.mathtag.com
pixel.quantserve.com
player.aniview.com
player.avplayer.com
prebid.a-mo.net
prebid.media.net
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev
region1.google-analytics.com
rtb0.doubleverify.com
rtbc-eu3.doubleverify.com
rules.quantcount.com
s0.2mdn.net
s1.adform.net
secure.adnxs.com
secure.cdn.fastclick.net
secure.gravatar.com
secure.quantserve.com
securepubads.g.doubleclick.net
static.criteo.net
streaming.playstream.media
sync.teads.tv
tags.crwdcntrl.net
tg1.playstream.media
tpc.googlesyndication.com
tra.neodatagroup.com
track.adform.net
track1.aniview.com
track1.avplayer.com
tracker.neodatagroup.com
ups.analytics.yahoo.com
us-u.openx.net
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.youronlinechoices.com
api.rlcdn.com
fid.agkn.com
104.111.217.42
104.18.25.185
13.32.105.197
141.95.33.111
142.250.186.70
147.75.84.158
157.90.71.190
162.19.138.117
172.217.23.98
178.250.7.13
18.66.122.46
185.80.39.216
2.18.232.99
2.19.228.187
20.101.38.191
2001:4860:4802:32::36
212.82.100.182
216.58.212.162
23.215.22.18
2400:52e0:1e00::863:1
2600:1901:0:8344::
2600:9000:223c:fa00:6:44e3:f8c0:93a1
2600:9000:2240:9200:8:455e:4a00:93a1
2600:9000:2250:3400:a:e047:752:b361
2602:803:c003:200::51
2606:2800:133:206e:1315:22a5:2006:24fd
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700:10::6816:3456
2606:4700:10::6816:35ad
2606:4700:10::6816:445
2606:4700:3038::6815:eab0
2606:4700:4400::6812:220a
2606:4700::6810:85e5
2620:116:800d:21:e365:4988:e8a7:3270
2a00:1450:4001:802::2002
2a00:1450:4001:806::2006
2a00:1450:4001:80b::2001
2a00:1450:4001:80e::2004
2a00:1450:4001:80e::200e
2a00:1450:4001:810::2001
2a00:1450:4001:811::2002
2a00:1450:4001:812::200a
2a00:1450:4001:827::2003
2a00:1450:4001:828::2002
2a00:1450:4001:828::2008
2a00:1450:4001:829::2002
2a00:1450:4001:82a::2001
2a00:1450:4001:830::2001
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
2a02:2638:d::2
2a02:2638:d::a
2a02:2638:d::d
2a02:26f0:480:25::1726:6211
2a02:26f0:480:7b5::2c79
2a02:26f0:480:9::210:ee05
2a04:4e42::485
2a04:fa87:fffe::c000:4902
3.33.220.150
3.75.62.37
34.102.146.192
34.107.148.139
34.120.135.53
34.149.12.213
34.195.250.234
34.196.26.133
34.252.16.161
34.96.70.87
35.168.115.78
35.190.39.111
35.244.159.8
37.157.2.247
37.157.5.132
37.252.171.21
37.252.171.53
40.85.112.191
44.214.59.34
51.89.9.252
52.205.24.151
52.222.208.154
52.59.102.99
54.159.46.45
65.9.66.97
68.183.18.251
69.16.175.10
88.221.168.207
01b3762a10e39557f9c201e926232b387813b1ec2f7ecae96fecc06c656059cd
02ba2637239f12ec6c517083a5e3f3120c7888f322e656671d98011646d443bf
0325b6c9e68ae3f6ec25f6817b4daef364bd99c2ff5f04588fd6f956bf983b97
032ee610899049b073fdf790620af5864399548b06ac91cd2e57114ef45baa8c
039c7c741b7e5db216057b8f904b22cf32a60ecdfb4ca5325fb21708353a4712
03a2b4822453df68a44341f563e92e4c2a9df51ea2e1136b9228dc12a730798a
058bc5e95f1b17f0af263e284d3801d683cb0ab79cee4bd2d5265ba0e2d6b336
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06dfd43c4b060f93511c3616a9224c236169a690f319e9d982085210e2122189
0761599a569a3a6c03de9e05afc2cf135fb6581abb26c89b3615f46988b31fad
07728752a368d41c2fe1a3c5178ee2a581b1caed13f3b58b6271b0b3aa35e808
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
0a09c2c6747041f3de17afb29923b231c27108e86cb4f3c370df29087f112f5b
0ab0e347c7e63992f8c4a48c48d7b7f7cedae136aac1a9fed66b2d488f23cb5a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0b91400591617ff92c9fc737a11b29e3a82e22403987b29811432e1b700371e9
0b973a1fc6c2f5b494d0476015f47f5da42d1fd968310924e8c49f820a6c7eac
0bdae78710d2f51b913f548d3d0a21818944ab44ba9269873fa118032821df35
0efcb7ca122ec6c162d9570d27679edcb592a1bc641debfc4cf582f07ad8d45b
10ce5235b9c4936794b60caa8830bc5d4a37892f4061f2f97f183f9f6209eac5
1143cb5bb10e4ac7b88ac53502a88a794c44a1c5e6c7312eb803840c8d16fabf
12244df5789b5df67fcd42893b16e99a494eb0469a7228c3dc5afaa6df207da8
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13f329a0d3e082589a14177df4778b45ea8cb3826ce3b945fcbb0721baca5825
147fa9f0978c6eadd0d2ed1783952600685812b83a3e143d903db422e9e69b02
14c77f954be37da1e7fba8efd1279e7ece7e384d33b8375d6e6a1ce013daaf47
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
18e521a5d0510315ef33808b763b097ba1e9778b5f788bb458cb2b40c75274ac
1b26c04ff19851d0780ba6dbc37d4920b48f3eeb54963c9ea1667941e01bb7ed
1ce41b73897e14081f9d26ecca9b7aef9b3df4371e588a104da38bd96c356aa2
1e6a5449728ebfc51d230927f284d732366fc61d350d279b924ce91cdb79bc3d
1eaaeb5577cd0914f1749f095a243accd46acedc598840f48994672c8a0825ec
1f1c0e9e76f5baa28c2453d0d02b97d42e5f66283f0d3058a4ccc366e7f2411a
20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a
23161342549fc0c8700e4547eab70c8578bdd13049a07d31aa690d3816f9a571
25cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd
264fb85003051e903c07ed1298a808790999c2d216794f0c232dae31b8677a11
269db599f3d178bf0a66b0a57b690802bb9a9d23b5c46f7e24658237ea7957c6
27af549b88fd1d89121da082eb63e01df88ca6881aa7e92725773568649e6e1e
2805e6140273834a39336a88ccd89129917775020fbb4bb2f503c574f5d7e282
29765a09ee703903afb30267b14007723160a607780b879e6eb0e9d8692f6b78
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31d0107c89add7d653e70e8c25c9147613d4cdb2e242af8972b1b831b4a2fce7
3251b0d8d08473d70115a27162a574fe4376d42026ece1c55ab7166b63f10a10
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
337200fa98f6efb3cb86520e37b7142d577e304449b63fc1c65e34d6a2484305
33af1a2e956e9cd1567753858747397c9ed62540227c7ddd3600a4856977d765
3532a807c3416a321a14d2e03f65872f747837a3eb23aa8571304ca6ddc1bec4
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
369f20e17ce9308e9e488e6fdbdf3aa0e3c8c4705b903c23cd610e7c41eedd16
37e314bfd8e8cb9262b5ea01059377cea510e23b2215fc93de8b34a5726284a8
3857634543824c46b5f1f435e9375e75e0ad96b16d9bf4525e54f0f14bfb25e8
3ab57372577777ef6642a46321e4f051c0edbe332c0db18b00fc26c5c18ceeb3
3b89401fea631023de67ae75bf8f246b1af109a9a4247c3862016949eacc462b
3d3d23cbf6153d782e61702c972b533e5f359b4ca10b7979d29fd2289d2672e8
3d94d22087df59281d402ce90aac94a521602f6429ce32bf987a3dd5d46692ed
400fabe35a47597142482001174f415493a18dc7e1d35f2f66385013b7dd1e02
41c8460c9c718fb0e8c275b7baa9083f5477ec0919bab552ef952ecee74c567b
42c211109f52303a3825dba1f6ecf3257815017a59dbf07ffc1956aeb236297f
43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44333775bb6d918e91e3f41b850c4b0e51abcae6d11a5a816f8e04dacbe3b5b2
45b05fa503b274bfbe5b626d88f80dd6992b0942c5c4def10d01b4995b2aba79
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
46b3e081067e631f9a1049fbfa37844da854f741b7f9a45900dc02a19a4ef143
474abb3512d312b2b544ddfc9ea0de72c38df6f92810d2219c6c7e609f867a76
480613f771d4b2960ecbcbf9f0a8435d009d8f5fd10ab14bba1b1018762708e0
496ed7d3eb868f74065c9c4f435b0d4afee4a9f37bc4934e7fbccffeff98d3cf
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4ddf2e75347d5280d7a42f0db3959ab301afd030ae6a2a7d2cc729115433a532
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e46f9af568f30cf6b0cc6ae79329a0b69f686a57491e9e97ee1dc44a8844c31
4f3078d79f59dca43390c202e38a3a25ff553362dade74143f41f7eb8046a7b0
4fb80b7bf623f709e8773d63406d7d20cbb8dda584d2259f86b7cc94050923d1
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
50a754759056b8854eea40f5546ba7b21909f3d7187304b2a3681e72279fa12f
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
561f6655eaa2217e42357e80189b3f60a6dea1b2ab6eba64e35c83404037e432
58ea64949b103462e43fb71d33f6316dd0755d4a7ce20eb13bbab9f94f3d4c82
5c2b8ed90ea508fe635e1158f1b465577b0b6080034df19f7ee1268cc4df50da
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5d18193691964b10a7e68b0e3332053e4d4bb8c7971559815345697fa5fb1a04
5fc6fbef2fb8eaf187a27ed6ddcf9e41d40d74fb8f2ba6a70050f4ff4bec74cf
6095d3fcb575040e15b107d84c0232718cee51137d2590afcaee269576bc1c1d
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6352477f7dd223e3def9197581b2c43e9de34d6220885483a00108be24acb741
63c3ea6220254cd3c792d66792f9adda0dcfdf60849c4cb0af767b87ea421f2f
65b18c620a577434cafb394446a41fe9308c6fe7fad6f3154d143405f54df5bc
663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707
66d35649a7a52c5dde7a671e4a71fb90bdb91689b77a58c928a8255ea296f067
69400060a0624356bfce9364c4134b042a9a26a9d8c14699ff27a51b77bdec8c
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cce336f4fcdd345b5311dbacb6040eafcd60805f98054fef1715c7a90ea06b0
6f5a74ea4fa94eaadca122239fe4031ac54bc6ccd5dc4324c2751ea86a943124
71fc1599035adc6bc34df2117b8631285905f97737ba730af28644ee6a0d8dde
7348a2eb48c9a681d6178433394c7037144d85b57ee33a11339d3a33fa1001a4
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
750d70bfb8a9982b827656699387de0b63da65b2e9a247768005d9775bad42b8
75f7af1fe244190576acd02b03bf98c68ebd75ebb221001ded5a2a55c5322827
78f9c1e43e2415f0c776b894740117b4df9149b0c3cb0da6ed6c6a163a20d3af
7dc34bc082196f1951e9f73b3ad1c681cb38ea1d261031b8f65812db383b057a
7f6adc9ebada7e6287736727e720e9f094413dc86d57bcb6f399dc459169529c
7fa335c8ef3be2271bfc30a3533d218ff26e04cfbe0bb807cc6a360691dfcf30
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
7ffb78034d200f0e666ca72ddd3c94c3c5e54d6ecbb207470869938e7c3ea591
811c20ef9b8b5083c4d16de69e900ba65d98ebce36ac7bd35577ff71e4af1d7c
82df16c2b9566862302bf45688a07667a9e658325d3fb54e5dcf9482306a39fa
831997ce334905a4fc3c7f0673c30bd34701f9810d87b19335aea228804ae38a
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e386403ef04fab3349f1e01862b1313e49e5dbe66dba3acdbaa671515314fb
8548fa5f198e18b0feca552d0f369f4c9fc15b9990ef9d28ab2fc556f3e8153e
85afe5d6b60132a4c60a797263462587cbedf641bf528a053b9a63753b7a53b8
87164df907b04e7cc17ecf6cc67fc70758df16f4abe9ae99fdbb24ff5d2ff3ca
875a318ebf906866ab16eb2e848924b12c38f7d33ae1c6e72244aba92faa9b7b
87bdf34d158b451ca6e6113760d8f959d43ad17373c7ac0aa70b6789f21a26b8
8c21db1c2fdfdb84f42273ef970a0c6979e0c8c90d161921f262545ebaf9d961
8c3c8a15f532982308c679f9eb63f67c5f66f09e16f375d73da933e7c9dae96f
8d39d8c07c66cc67e307318a80da7b3c45f7073a2e1d7e01bfb05c9256a5240d
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8eaff8cf583969b5a13ec6f821a48a3c8d2c3ca768997ddfd551207a2e90e7e0
921f031dcb2b0ebaac6b76687ff61e588c0c6f78b2f264183607e1cd04f28f5c
96104e2bfc935f12dd30992ba51e7cff38995d1e3610c2e7319b3fa82b2ae529
97cf4206e208ceee4baa88c1d02f47176d84c5c84f85f63bca9d23aa9f077dc4
9aa631e988972b5d7514c67e380b577ab5f921e5e0724801673d3b7ff2d9f07b
9acbf16da30c0fc66a31cfaafc9d2a14fac8eb5bacaf2707cb13a710ba53b667
9cf4fc9350f69e442ebfdf130d4e601377e9273b642282a1ebb4f79d6116e8c5
9d092ff19d413c576b9d02b3d2ce1e1eb583d71ac2601543ef18d0e9f720dd24
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a288f6d8bed5da66244881b97b6355d945f6ca755c1fc09b750724745cceae03
a29ee2b15c494311c52521766e44af56a3ad2248e7a8ab465e5206463c13d288
a3b7eeb38d81686c533bd413320a78e3f48808a986344345bce610fcece0e6e5
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a63f6ee7811c95c619d7c10da51d3cfcfd5cf3ae067428df7f49f63ea3e3c99e
a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596
a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427
abb1400af20950e0443ed73d5160d2e0deb83e0fc6a99225fe2cd285472995d7
abfaddaf1f0c21fd09a16fcac7fdcd7927e2d12586e9e86d6fcc85095f977715
aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4
ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910
ae10d3d6ff3d87a1ec24d04f044ad8f6d450469ddd755b9f50244dcdccb383d0
afbbdc0819f4044cae8d0ffb190d2bb5f00af7744bb6091b7ccc12113858bdf1
afca8c7886952f5543b3b55ea0fbda3e19239c8cd40ea696333bb5c5880fa138
b011d8462b79069344ee3df21a664097cbe3f2be5ca91bf948f0832f89e0171d
b1276b7ab7d47020184bac7356044920bd2e92c3c14860f9d30f8f8469fdedcb
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b4a0aeb3f2db12edff7b757d79dc72c1964f48040a73651ca0e6f24c775f1264
b68411b5c2089d3bf7893dece808f91a8bec4cdb2efc3a6305fb239ea7bcf2de
b6b700d252c39b2d4bdc4b268dea076a3e20181bc4c7c4e8464158c37358856a
b7a0c757f7f6389ac7abdaa629e26a6098544ae42b571a36b74e8106c9b36e0f
bc35c9a29fe24bdc0b2a499f9030cae5218800b30a37e3b9a4b36f8addb42ab5
bc4a331f1ff34c4247d1f873e3e40e3d0a9fa8fb0f0ba9871bcbb10670d92c37
bef46c43f3efdb52f757d5c26af73901453eb3cf1396ba163f63bf9d6e950f00
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c505f7e821ae7a1c88e6ce02d8e38b57233d9997445ce06b9ce50be989df5d7c
c60b9cdd760085596bca42b06c9b4c42fdf81b629bcbf288eb5e242b93de017e
c6a1483dae24b1f97db14d882e182b0c281cbaf3c3bfc6b9f1b6c0920692030b
c6d757cf5862c02b05d2e312fb16244206e95a5b821b875dbbc3389617c63495
c74d4c8be63fda641c0e0255ad3c7416862f17e31442a1a0ddd7645bc2d69d3c
c7fc4a99ab664906d545b36b310a40b58d9e41986fcd9318ac8f6f90e41d61b3
c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b
c8223cc5d11f9c0e7b42bcf713111486f82a8210e703ecd4a4eaef6352683e90
c9f39cd5a8a858728ceed2e8c19c20a31903b3cae44d67bdad6ee75e9068580c
cc4966dad7fc4704126cdf868f5ed8fdaff28f3ecd0268039cb18ad7cde06457
ccfb166b430d87f842c6d0675181a9e8f6be8a9c1a3c074f2eb80409d96865a0
d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d1ced72911892365fa799b44af92240a646d2a3b3ae47a8327a4ecda27bdd3bf
d24dba5883753b029f54ebe1540289f00d1381650f47d2ade5948b11d8ca1e5f
d76d455735329406de99b3a2f727e168d7e924ec56c8bca02b2c3b657aa95800
d7bb3c50cc5b07cea81e62a53039ec4aa49cd718058cbf799eef27bbdb5b958c
d961a31d3d2fdb93a35a4024f9878b2ed896cd86a084ceb8df6af3bc53e29125
d9aa165ece71e3d909e4ca104763875a7272f1d4f6d16effe5c4aef9c65c1f50
dc15ed14c23ce1a976a7306db458305071c0a119026ecff8be8536f28684e391
dc9a623e55aedb7563d96a2bd367237c17bc7d9493bae1300cae0e4e3af8af52
dcb21012ab9d86633f36b33687e2ea39d9cef2c12ef04cc0ca5d9fd56ce0bc5f
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
dd24954dc2ec5ed03a3020544184481c5d8e27ce2dd0a41e95d9fb4ec336ea54
e0f6ce9b91b49e1854b7b6b74916e958e74782dbf0b455a625c28f94c4b64d90
e189eb8fb761166a6d657a8dbea2c5d73e224e565716f36406ec7f7b68cd78c7
e1c3c2dafe2208caea4f809f414a89a9d256deb8671e1c5d49bff9a873782796
e38a5c4d09ce22745e0111e294c8242d11361a3b3ad87398ec965e77fc909f7f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3f3353c815917acecb4d30907c8633a2990d3fa7c2faab099b678d63ced56c0
e4446065ebfb65a302d17b88e2c7ed326d8402769eab0843833dea049a65c992
e559f6ce402ca1a83c5706d906d50ff66412da59820809195d4c3fc6cd4fe24f
e5b5a916b59197e47395f7d4551e2b22ca1edb4aab399391054903d5d70b41d3
e75ee4e9cea69d92bd780079c7f6abdc0529fbfcc67013c41e36e16fd99f28f7
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
e81437bacb2eadf8e9892f7c4423437a86ed8249bf77dcf71770909857779174
e84df8f588d48b77639986554b3fd632ced1d1464d5b1b5535b4d1523483716b
ea41d15456ee37d2a38a1e31034670ced4a19f370a3031353bc5fdaf020bd43d
eaa3d12c6890efadb732d28d679f37a9d9f513ac686e7de453e82000612a7536
eb96ff4ec4eab3ad829d1553f190bf1acd97e88d17de54f1614e6fb54109499d
ec81013fada9e239bb9d91316ba5cdfffaf0f7a1ea4220ae81c271db75b71a5a
ee637c7a5f0b07ef41816916b548afe7c31c301c6ebc1c8af908bedf2ded5f1d
ee9a49aae5d1fc7602361ae5c6d69fc8eb128d007b4dee67d42ce19bbf2c87e0
eea88861c60dda55fe15b54c8e8f300fc2c01f5fab2625321d9af973c6dd5421
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f00c8a9b21ce0366e1823f775d7568aa84a11b73802dddbd88dd0325abe24b23
f1177492b054782e2fa6785f309a458507bfbd28a70d7eaac3ee4fa31d585277
f3f47d6a938ede7a828ca47022eee50835e4c9375f7ca41581fa94e25c8e950e
f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f
f68c8c5b10569e4cfa7a8eb1f137a96a5a6b6623e02e24170d837afe8fe0842e
f9a760b72c5e5af453d5718db618d44d80dcbd2f76d074267b8e9147545e9bcc
fa7889a593298971ce988a1b6b8c084bcc4e4c12226261416bc89e8f8a661a5b
fb2fb6b4f65872e998c55859eeab6acb219e6e1290dd635c94853dcc493b4739
fbfd3438e10ab28f28f2e1a1fb2ab3bfa431336af08a72f597c0d4d73bfb046e
fcf4046b2825d297d3cafd03ba5757b6fae51c7356c791664505f16454be09b7
feb87ff6c8928a530994bd7ca34d4b0c9e9a0dae89eb82767e587955c16767b5
ffb9beeac0b797a41b0aa254420decf3e28417c6d2e171a56ea0a48dfac7d8ba

earnme.club Open in urlscan Pro 157.90.71.190 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

374 Requests

94 %HTTPS

47 %IPv6

63 Domains

98 Subdomains

84 IPs

9 Countries

5298 kBTransfer

12620 kBSize

41 Cookies

4 Outgoing links

Redirected requests

374 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 21 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

earnme.club Open in urlscan Pro
157.90.71.190 Public Scan

Screenshot
Live screenshot

Full Image

374
Requests

94 %
HTTPS

47 %
IPv6

63
Domains

98
Subdomains

84
IPs

9
Countries

5298 kB
Transfer

12620 kB
Size

41
Cookies

374 HTTP transactions
21 data transactions