game.gnlore.com Open in urlscan Pro
167.88.125.7 Public Scan

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C33A1BCE82AC4F94BEBAC736CEBA73D0&google_push=AXcoOmSoNf8Iyk5JDHCaI8mhwG85bIiRN_bd6ZZYtEkkr8spnHUkJc6aVTZmTtRK5XQnIA38l5Vf1o6oy0cZgJLEfGEnyB-6eA2iHFgr
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 08 Dec 2023 20:30:22 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1CAF
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEPEKwh2vAw-HG8jwDm4wTsM&google_cver=1&google_push=AXcoOmQN7OErltLD1ACNCGVNF8tSU0tFAAMt1rPTHfYrCsrPanmt8Lid_hnyE4q5GoDp0Xrnt2iyF-EQ3De...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQN7OErltLD1ACNCGVNF8tSU0tFAAMt1rPTHfYrCsrPanmt8Lid_hnyE4q5GoDp0Xrnt2iyF-EQ3De6080nqWpzH4gNVwt2qf5X&google_hm=QYozsD5SRam6UdXP...

170 B
232 B

51ms
51ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQN7OErltLD1ACNCGVNF8tSU0tFAAMt1rPTHfYrCsrPanmt8Lid_hnyE4q5GoDp0Xrnt2iyF-EQ3De6080nqWpzH4gNVwt2qf5X&google_hm=QYozsD5SRam6UdXP2Axbnmk

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:21 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmQN7OErltLD1ACNCGVNF8tSU0tFAAMt1rPTHfYrCsrPanmt8Lid_hnyE4q5GoDp0Xrnt2iyF-EQ3De6080nqWpzH4gNVwt2qf5X&google_hm=QYozsD5SRam6UdXP2Axbnmk
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1CAF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEBIlpl1coibuOgYGov85M_o&google_cver=1&google_push=AXcoOmRpIOQOh1_o2QZwx1CMKPMWhNO23no_QqKwn2ww1-1SUs3Ctn9XFEhAPiKR-u9KghazYfysshTP-a9ut_BDh6LyZq6...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRpIOQOh1_o2QZwx1CMKPMWhNO23no_QqKwn2ww1-1SUs3Ctn9XFEhAPiKR-u9KghazYfysshTP-a9ut_BDh6LyZq68eMsZEYjg&google_hm=eS1HMU42ZFkxRTJwRl...

170 B
232 B

49ms
49ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRpIOQOh1_o2QZwx1CMKPMWhNO23no_QqKwn2ww1-1SUs3Ctn9XFEhAPiKR-u9KghazYfysshTP-a9ut_BDh6LyZq68eMsZEYjg&google_hm=eS1HMU42ZFkxRTJwRlFpbmZfTXJnOXAuemwxbjZocjNfWX5B

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRpIOQOh1_o2QZwx1CMKPMWhNO23no_QqKwn2ww1-1SUs3Ctn9XFEhAPiKR-u9KghazYfysshTP-a9ut_BDh6LyZq68eMsZEYjg&google_hm=eS1HMU42ZFkxRTJwRlFpbmZfTXJnOXAuemwxbjZocjNfWX5B
content-length: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1CAF
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESECLUQK23VQXxBt6eIHWquds&google_cver=1&google_push=AXcoOmTMaf9zuF5NPPQ4nZUxkw2eZ54lsc1ZdiqwHM32-QbSrGc7YX6E9477qReKRCdGa3C7xCE_CCr3b1_a...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTMaf9zuF5NPPQ4nZUxkw2eZ54lsc1ZdiqwHM32-QbSrGc7YX6E9477qReKRCdGa3C7xCE_CCr3b1_aJTOWLvH8vtZKCuYdv74

170 B
243 B

50ms
50ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTMaf9zuF5NPPQ4nZUxkw2eZ54lsc1ZdiqwHM32-QbSrGc7YX6E9477qReKRCdGa3C7xCE_CCr3b1_aJTOWLvH8vtZKCuYdv74

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTMaf9zuF5NPPQ4nZUxkw2eZ54lsc1ZdiqwHM32-QbSrGc7YX6E9477qReKRCdGa3C7xCE_CCr3b1_aJTOWLvH8vtZKCuYdv74
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2

200

report
sync.teads.tv/um/ Frame 1CAF
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEBqY4QSfOd4C...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmQAky9nn442IV4SoG_F2wJmTqHDCCwERNeR7QOyAzQUA_KBbTN69Fn69mBnB3m3pJgg6yqVQjrJnuQuxlWXiedUyruKi4rSXVpt-A
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

87ms
87ms

Image
image/gif

23.43.61.33
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: H2
Server: 23.43.61.33 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-61-33.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Sat, 09 Dec 2023 20:30:22 GMT
pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 1CAF 0
139 B 152ms
47ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JlYXO6MmqzIkIXBe7c_Ur0MXmLON3NFlataF91U-QOkr3saY2ef0bVR0xFHoW-7MuU8-Nb_g

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9927
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CNabTXM50ZdHqG46_1fAPpfSkmAOzx7Cjbovh_duUDNrZHhABIIzqln5glYKAgJgHoAGumIqiAsgBCakCYi2If_cOsj6oAwHIA8sEqgTnAU_Q4Ai-Vj_fnudLBLLh9zWN50If49diAJbZEv2...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225384952112682315782%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22...

0
0

158ms
75ms

Fetch
text/css

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%225384952112682315782%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210426733634748480545%22}&andc=true

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"5384952112682315782","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"10426733634748480545"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 20:30:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"5384952112682315782","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"10426733634748480545"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DBE6 624 B
242 B 82ms
82ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiA4Z3cATAB&v=APEucNU94VHhfp_Dq3-DS3fkrxJZg3m7yN2ivIUcktJ45KfmtieYKoY7vJzOXJrtYnqpMCF9oHegd_0zb2wK2ExS2YAYS8rd9Q43iRTO0chS0WHjthK4CO0iCb_TIkWTQyu2Ll3_gOoE9Fwly5MICzWYdncuidGIQZnlclnspcXMadTO4OvPBXY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=294567026&adf=1407713105&pi=t.aa~a.218775750~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=1541&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=294567026&adf=1407713105&pi=t.aa~a.218775750~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=1541&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=13
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 20:30:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 1D5A 24 KB
9 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5592
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Dec 2023 18:57:09 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 1D5A 7 KB
3 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5592
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Dec 2023 18:57:09 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 1D5A 0
0 180ms
88ms Fetch
image/gif 172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst9fHh4ng8Kl3xRhi74zC1sEk1yZ-R5k_-pwxAspIoWfuvl7LoSp3UKSSzjSFXTi8KqHXBFNuq9hX87Kd5wyPYFBhTCpznWnl1EdTzsXK1OiXDRk8YhftNe11d6rhG_Q6a3zGrZjrORN8NMeO1ewfAkRpVlsZhHZrtwpmluNuOZW_pT0nEtiqBXjNu3tDIAbLA1EnXdJIm8whZv9bw0Gg86b2NrXJFfYHHTJXzyEA8AvkqcoHfiIOOyTdhPNkkPeAFRJDf8_i9VESmgXhVXJalgLHgWL8rLfa7oTVagZGnDZl6LOIe3lyz7WsSa3MaxLGs2WD_rJtNDWfpwEpAMkrYxbAZszVaqfwSBR_stsPn6BkLhtYebM1ZIk4p-Rgmg6rJdXtRKO-YWo636JEfspO4qUlUx3zGlYAYPhUG8UH_OiknROZrPCWgd-kBHiEGwJm8Ons1xzojvgwmjzmAPxUeVTQRAKF4xip__uQDMe_MkLmzudTCYFpEN_yQlF1EM_OKp_0CY-nMXjSbua5JKlwQEfYAJs6hOqCYGEqBNnx840sY6HR649wWixhcxGsHEEM_mTiQvTTENGFbFh0p27uBtqN-F09TKiaoYdWagyHTEBI7qyR2-op_-n4Gf_VUoN_yDGyT2F-RepJzwO0R3KYZBSU33sMQt9M_WICtEFG_mG0FRtzdNfRJ3JbiodUwgdu_HYBbh2FC2DRjcQoTepPwZ8iPVWdeGJd15sdCy9FogNUfhS_5XhrjyImTzMnqGB7u_9yogo2YCB0jfJYrSLmQ9Rbnon9upSn-w2t5ImLSbn9Qx1virOn5mgN98qAlB06duu0M8-DJScXXAgvJ4AF7wscmqmAoxt2Gx3BdUijO91wT7bRWibsVIDSCuTtdqkysWfal-LFDIkTuzVRmxiUKBDNBDOnNOAc-EY3b2SschgUtjZ-IcQGe01pd8hx5UCiDRS5mtv4hqq62mig469Q0SDBx1NaWNuP946YmMgOjS7b8i2_3eJGHpNsjN1u4UKMjO1mAzRuqtkM8TscRDN6I5bOPKtyJRsj81LFmjOSTvNj0wb1i5Dggb3efssflnL90LJjhZG2u4cLGpOP3ARixKjeSOjVZsGx1TMf6icXPtvTGH4Hm_UZybwJwKAjhNj3ZWuhbHge1Gti0EkIjbK8-0MCeMiU3UL5I2fhVKE5q0K8d7e7W1mH6jjtQBs0iJN2cU8BcGkaIl6LDbabkTjzci3VHUSs_1u0uj8rhnHtKohmYmoevDYqOCBI2-NGgxYXwA93dt58CyMlWnjGsVj50ZDkCu6FnQB_rqxFpELrmFP7dDHDKURmbaRVnTVbmd4DA15U5F2_uTgKCh5vOyGcP82qUJczytDwCQBA&sai=AMfl-YSCL2VaRDzhf6EVS4X8JEYsdffdm3X8QTUh-yoDtdAajbFV4dGcBYpiAabvIKO6vN5WLBpZxF50Om9lrMJWepNfObd8NgD9S1k2QAP_GVwP_Ew6GTA3EmrhGqFV3Q26rpP4mWvah1uNTGAjOCXrEMz1_OD_1f0j9YUu16lAWOir9AH40JSM3iF8U8Ak_WgyDW9D32SCTdW6TereVTwIKZfiI5BFUSKC_qJnF9CzWQzFXseUw-BvZvXcNDD-9kv5AtCfCsSkH8j6qjqV-3YrNQt4q5zeWp0fzTeoKoAKR_aABzghjq4mpxARDLMiLtd-3nd8KHTbBTJC7RV4uorwUPxEm_kR-7lLcaRvn4aYjgKhxElTZSe7v0zNFgRl24brcftl4G6euX2VXCoKRvQIVgCOJeog3R-NZFx0963xc5U&sig=Cg0ArKJSzOP1RuN9z9VIEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9maXZlcnIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20231206.34554&arae=0&ftch=1&adurl=

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 1D5A 41 KB
14 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 95113
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 1D5A 3 KB
1 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80903
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3D49 1 KB
643 B 44ms
44ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 15131
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Sun, 10 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 1D5A 20 KB
8 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85690
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 1D5A 0
0 48ms
46ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSyIYMx9U-uXBHyscWjqtQKn9yYokRmmewIWIqRiUsPFnigSYdpZbG_YxFC-aVLfQPbSjoXORSnghi6fs-_4k5zgzYMUg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=294567026&adf=1407713105&pi=t.aa~a.218775750~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=1541&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=13
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1D5A 202 KB
64 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 20:30:22 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D5A 42 B
63 B 76ms
76ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C7I0ZhoVX-cAVTCBCPJfmmZOfeO7CJgB51f4ERT8PZE4Sxr1BIwp4pdowAyOF_bc5uxMj3yxjcuo1nvEgf2rz4GgfO7NZkcVGH3wgT2XiGhs9EKZw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4431902876421974796
s0.2mdn.net/simgad/ Frame 1D5A 75 KB
76 KB 128ms
40ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/4431902876421974796

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7adfb3bf9f8daa4adee7cf8ef871c7631ed310f243e6383fc1de48dd12ba3fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 14:09:56 GMT
x-content-type-options: nosniff
age: 109226
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77251
x-xss-protection: 0
last-modified: Thu, 04 Nov 2021 13:52:30 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 14:09:56 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6DC5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIaEG7q6Ot7jJPcymVMn1Zw&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIaEG7q6Ot7jJPcymVMn1Zw&google_cver=1&C=1

43 B
733 B

76ms
76ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIaEG7q6Ot7jJPcymVMn1Zw&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUwWd6qEvbWF45DsWZslD84KJ9YG0k9gjVKOxdRG9LXydGHxiqNQ3qUzCb9ivQk3zpbsOq8x8xK-L1kTU9EQurLZza7eEF7c2GuijodYGeX-bN3oEKcw2etob5dpUp4Cq5hkSAkJ0Mz3Pi96WRB4CpvS2Jcx0TOeHLyWIfZI-TNdNJvgxI
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uANM8cor%2BjZI44amWvotoIK9%2F%2BtTuDzjDl5wbNcRRZhT3MF78kKSwyngX188Z53d6JAA1etscfLCyqQ4y21%2BtWgX2eRR45wlNJ0Ogq%2FcTEE03dy8Uc7LQOvroB0NsTN4i6666HviMtuO0w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8330016cca526a76-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CcitObiNrPAFRkpmkknnbRGG6zeq2fKoRCBWX2qbo9F4DpR37kM1a7JmLloywj3D%2FNFPAiBjb5XeRTZsvbbHyNZWulp5WG%2F0amVv6DbPKayZJFI8psj8%2BflAd2F%2BrkiEZ3DEHDfXqU0a4w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEIaEG7q6Ot7jJPcymVMn1Zw&google_cver=1&C=1
cache-control: no-cache
cf-ray: 8330016c292158de-TXL
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 6DC5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXTOXrjyJZrSxKR0doxnDwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1

43 B
735 B

104ms
100ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUwWd6qEvbWF45DsWZslD84KJ9YG0k9gjVKOxdRG9LXydGHxiqNQ3qUzCb9ivQk3zpbsOq8x8xK-L1kTU9EQurLZza7eEF7c2GuijodYGeX-bN3oEKcw2etob5dpUp4Cq5hkSAkJ0Mz3Pi96WRB4CpvS2Jcx0TOeHLyWIfZI-TNdNJvgxI
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lEjAKiImOwH6KnDfl4njzRUDkTUYfZjb5oUXqgF4OkolhHgxrMmKAjd4z984%2BFz3X5pnrzWdY0Tl3Oo%2BfFYGYhhHVHD8nQpIIrN19ocDU4Al9htKEC5XW7kaZn%2BCDnQ8x%2BUcy9cU92aIfg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8330016d2b106a76-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 6DC5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEORIotekh3n6Eh9BJ5eiWeo&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEORIotekh3n6Eh9BJ5eiWeo%26google_cver%3D1

43 B
887 B

44ms
44ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEORIotekh3n6Eh9BJ5eiWeo%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNUwWd6qEvbWF45DsWZslD84KJ9YG0k9gjVKOxdRG9LXydGHxiqNQ3qUzCb9ivQk3zpbsOq8x8xK-L1kTU9EQurLZza7eEF7c2GuijodYGeX-bN3oEKcw2etob5dpUp4Cq5hkSAkJ0Mz3Pi96WRB4CpvS2Jcx0TOeHLyWIfZI-TNdNJvgxI

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: 0da69d28-d73e-4132-9d62-09a7384ed462
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: c53f4090-d10a-40d8-b1bd-04e3fb4ab0f5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEORIotekh3n6Eh9BJ5eiWeo%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6DC5
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D

170 B
188 B

53ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: 9e4c2953-343a-4745-a39b-6a63f57147a3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2885 624 B
242 B 83ms
83ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COmR064CEPvCzOgCGPTP3d4BMAE&v=APEucNWWxRFNgNRGPcq68pYS9WcfLRqcrlxUXH_kxGSdxqMjfePlepluOZEi7-vJBV7TmZHKhIrULS33LTOppSiCoS-Ff7TxdoZMWsat6ss3AVwiJl13i9nHOYmz8L7fCaZDb-maErE07wlITLHEzjgNVYWp7QIPeJUINxJQbO7EgaQO_h3SJEw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 20:30:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 9F17 172 KB
61 KB 124ms
39ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 11:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Dec 2023 11:58:35 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/ Frame 9F17 7 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Dec 2023 18:57:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 9F17 24 KB
9 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 18:57:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5593
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Dec 2023 18:57:09 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9F17 41 KB
14 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 95114
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 9F17 3 KB
1 KB 52ms
52ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4962 1 KB
643 B 43ms
42ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 15132
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Sun, 10 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 9F17 20 KB
8 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85691
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 9F17 0
0 48ms
47ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT6EL0GymXImNJICKzQl3-OTj9gRhU9WFTfABWRkrJVMKLvCI-GMN9aG63i1By0a9gPD5RlmTJb9OnfaG3NZIyjso8PLQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9F17 202 KB
64 KB 82ms
81ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 20:30:22 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9F17 42 B
63 B 75ms
74ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D-3Rxx3rqDjiZTG3NxO_Ea9oCCeas2kqnrWXrvuA9Wkx4OFtpYL5c-1zXc7XfkzKIPNNManGAwrEuaQDu9PTQy_bbpGzNcFueGjMftJ4MrU24EXjY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame 1143 51 KB
19 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 04:53:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 04:53:58 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4AB9 4 KB
655 B 50ms
50ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=544349898&adf=1397456241&pi=t.aa~a.2282482148~rp.4&w=333&fwrn=1&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=3&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2054&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 09 Dec 2023 19:21:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 09 Dec 2023 20:30:22 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 4AB9 2 KB
822 B 39ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 18:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5710
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Dec 2023 18:55:12 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/ Frame 4AB9 24 KB
9 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 18:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5739
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 23 Dec 2023 18:54:43 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 4AB9 3 KB
1 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 80904
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 22:01:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/ Frame 4AB9 20 KB
8 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231206/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

21602d46c4e666495bdd0f84c3dfe552b57dd5111b4f1aa970a637c747635b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 20:42:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 85691
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5638635208567908330
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 22 Dec 2023 20:42:11 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 4AB9 0
0 47ms
47ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ7O9lcXntPTyGo7sn8R4GqwefHTGsTcfEMIQZV-FjEtstg38-QMTqZ14eMvu42OSuhmB1wS8BFgAeKFaD34z0Pma7URg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=544349898&adf=1397456241&pi=t.aa~a.2282482148~rp.4&w=333&fwrn=1&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=3&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2054&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4AB9 202 KB
64 KB 102ms
102ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a04fa6af32e77548f1c3e27b7014f3520c7494f317fa80b58f8704de83e4b821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65145
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701866768669483"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Dec 2023 20:30:22 GMT

GET
H3 200 f9d9b65dbd646119ce96bad0f484d579.js Show response
www.gstatic.com/mysidia/ Frame 4AB9 37 KB
15 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f9d9b65dbd646119ce96bad0f484d579.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

457852000f1b85c1d570224fe5aaacc709625fc3bff458ad4e8a35420d21843d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:32:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 316663
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15460
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 04:10:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 04:32:39 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame FF10
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C0ukBXM50ZYakG6DM1fAPh6qOmAuzx7CjbpP5_duUDNrZHhABIIzqln5glYKAgJgHoAGumIqiAsgBCakCYi2If_cOsj6oAwHIA8sEqgThAU_QwAWkgXsQegIRj6PUIo5a2_gDXeV8jycIdkg...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229550558386379610174%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22...

0
0

157ms
74ms

Fetch
text/css

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%229550558386379610174%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211927271820941715217%22}&andc=true

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"9550558386379610174","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11927271820941715217"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 20:30:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"9550558386379610174","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"11927271820941715217"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB16 0
20 B 75ms
75ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3488874956981&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BB16 0
20 B 74ms
74ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3488874956981&version=m202309260101&ct=77&x=1&cor=5078501900436282000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BB16 20 KB
14 KB 114ms
112ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CwCA-rucEqZRiDSBYR79qWRR84hx-hGOLhv6aZPNLliwIJnThB6fXzzCtp8qOK2W55f234dvEniMl5CCjEm-TAxJlfpwzPdPHRgXzSsniQo6PeGcoKH236Vu3dlEPvG1iQFkeEdUZMVSGswz9f7K9SKKOqSDJQtrUGd23y1PjzisgQYLE&cry=1&dbm_d=AKAmf-AgOsEATvLsVQXs9AhJ7h3rIGRjDnQJAg6Gx8UNw8iY2Hri0zd2uHJKZDi5o7DzwWFruiYpYn-5oK67qSIxpuBvqRtBAYEvnwqBIHhhlQRHhNIeIjzBI1g7e0mN1fwybYPL3LCkUHUTGIUVF4LUTwpVHoQgTNuke1RRFKzwmfW8DBE2GbxiPxJ36C9gZC3xaTrPMXku_3vt3BP018QUSOJAPsfwYW-rk1E0nvGdBy_s16fQPEkQiUSILbhU3gvr2CAHT9S9_-MAoW-_hi4-WfjZZWlJTmyHzA308ySiBYlJP-eqcLN4iKONToWGYQ6uziuPgCkOuNgM2DJq9TL3kkJn0Qx7bKtgd6kMkkhQM-pusJNJPQCHaKKBrz4wGk0Ix7Ligq13_PWwwQLuu1qXOLoXykeG_ydYLBxJKlUs2Pz5ULyniZM7rZ2NPxb2z6uwGOq9dTtZlrXQqjdLfZtwWY0RvOgguV_fc9nZtVYJuZ-auyzbua0NxreY-R_st--40o38o9fRUv4BS5HZ_kKRk06sdXoxawJmJ3CJ_5E6rjSLQ35licf-GSrgd3vDRKTSDdY0NrGxFOiJA7K4A5AvN-ldabUdjWScvACHyRynT7ovyM1otuGzBZsSAY1SSgQtQbTK9fPQnBhobFUdDQRPwua0jjgad4Qn7T2i_XZ74Izy8dJUHO-d48wljGWC15zn5olouGATfAJK_By0GXBTdAZpZdR2LsgDJ8hhU-9kmyLl-3pSPPGg19E6qUV_MCFsKbZNq2h7Qy7PVHnHAAkCFXkGIo2hPaS7aI2XHjUvvAF1L-qfPLcfkkEcju1MymCArFIsCqaAnM-csIocXeGsCcM_Vk-npJi_kMbDnTeZlE1Wt39LCCRHNQnmHCLWfHwg7WBHCmuwsgYU_Sq4TzoaUDgkVj-nbnO96tIAb6VIRftCEz_hDlarlVExs3OkKlh0XZbQQqgs7XHx7Ydh016V8RFQMbjvYm8tRcLmR7iBZwMP--UBZCFvyfj08qxlJsWTMktgAOE1pf6dLk0TdLL3xk2EmYX4tFUffs-tiZgvJDdei-qaP0JDEhpm00RzVz7zpnfoSGEoiEK55jsUxoFTpZzSBqT2ThFgRn1uFk5ktX-9OCGIaxDapIFR2f1ujME_cFV5Hk6Bl0ZlfkW3FVtaHjKSNJGyAaAQmAJoDYnmEmlYjSPNL-vwRctAqgvQRbmVoLGEny4ELO9Qr0F46Wijv7x1eQDloIGQBOBhna4R9a3Av-iYoS5bDye98a1ffChLqD_nGSk6RfMmXTFaFzUk7dAx8S1asMtxRQZ0DXpyMkEQFAcpCmyqq9sSPkyU_MPC3pEoaB5y8eoBotUIdmL3xRy_FNBl97DD9QDHdeZheiMcZfHkykr2IsyYqblsEeTePfUnFqAM_w7lOLUg4ITHq_SrSv5AIQfgihP6sRYqyzHKNu2vDOaCN7m1Eag11R4ROjp6kAytrL8Q2gpGlVbADvTMXXx-MYwXPwE3hYEhfJfN4lOsV6wJzCt9NFTPbIq-e91gFueFUmqZUa227JtXH7CfYLjugy6M3T-GHsU0kdf097_jeyvH2RiJUFnnMXTRrUTPkh1h32KAvT5pXyZYxF0mvENaH8w3toeKR4xHQMV-wjx13QVanOk3WgDPGZxcBqrbrKCoxZQxqAuO4GbzJpgqleSXyIJycGxPPEXFyJZGp6Yui4UMlvOn6V6q51nlpAcmScLIKC4JPGKVDZh_iAxIJj74HSPXaKNWCDdYkfv_RZSU-XvcsslDEwYOXdgLp2Xaq2vmn1fyfCtHaYxxYAJ8owh1h4yT7tLxRk2P5D7exYSryJXVzVSDXJO0gNl9M_MYBi5a5Tys-Xph0UzM3MFJ5eIyGjcvymS7P8KEZgqQP2o1lrw0INKMmfgVJf_QH3P4Mmd_TYaBX8iDuF5kcZfnSiWeQ_5gUHINa8iF121rYckgtFaNPwysfAcHmI57wNzZ-gc6_Lm_16kCibz35Dj-I27_GJ-AqtLa_Z9NIOC3gDetLRr9vXAW_efDzoCJyq3JZ5kNYSjLQsAW1-_NRk3Ksej2C6Abb-f--9q1ylAujYk1v_InicTgnXLQVODBYGb7fjqGNCawrvqu3DNWMFntAteK-nNJPrn3Pidsrl_ZiS7nPo5_gxwyqSlFHyA47VJK_sfmcmHU1Sdo3fDcGIaNKaXTeUmsnrUcPUsXDG0mlL2h-Wc600Kuz7-5IEsNQhbJ81TbBye4tFUUm4RVlqZOcHMxY8g8EViaduUGJmBHa0C29qCcZNARSahp0xIVoh75Um0Zf7FbaqmMbHybCchzPEHLcOyUICyPG28yvZmTb2CP0Ft6O7MW0FKfFc_kkMU2KMaE8Frl1-vEj9oURwQcqdAXsWZry7j0yIM-NWPlct6qGfZ3wGjXRR815dmW7RKesgU_EuBAdwjHkNihwRSp8yI2FRRz-hhC0BB4rs481vcHY21Ts0C8vrof2g-1wmyAuqLf0giW1o4-3gsUoGsBuPddE0CKTpd2mhlOSU5RZLek4mbo7B9w11jIwLndo8zvc3w9vY5YD_RrUj9gAK-cOUmJj5ARO-pHhtZpHY7eSSRmEUprpzk7kxNdYPhAlZvcMlcB996DD_iSywtgw9bcUO4GCcDaKdYc4xsb-7zKvjlfvZw3lJxhBnXU_jSRG267re9xUQQzKGCGTLYuKw77aF9tYxwKQDqN8uMRd6XhtJzUqdQhyXBUSMx0nPDwGlsCji6jb4vAVfIM5griqUsda2T_i-A2QkxhCaNM7sKEstDt4JY_MbZcrfIR9MbNHqCrBsjSHxIQiZTLULa8g6vBMMlkIibzoYegPVnichjFWYOFLV1drs-tokjnaiix7yogKLDYGhFie93m-0qT83WwOBHbuFRIV3jUmEkqk0-_K1mu1OkisTrpPP_sIgzazQVVV6Jc4YpOxg8jrpJ2bd1rfyX1Akf45ygBJcLVCAed8pbAODZxlFscWpRsOc-uzjbxdCh1xMCK950V8Ks9dBe0mUQDTRcnOihkKxK9X0PSCpuNvXz_jhZkXwiwquJzgv9wNGpWNp5Ce_NcD798IzQAduLXLRKVd438FPYBzymMV3Z1BEWjRq_HF9FOsekrqpglbxyAhqtw-QZ-wjTQ3dFZSG_C_kto9Iu9e2p9OmtvGFwFVAn2sQBa_y_OhK_Cs2wxog_K1sh1Z_NmgpGaSNttLcxPduISg3LhuxAWuoYyGpDSP3NxoWfDCX81UIFaM0WXV6e8Wrz4D0dRaf_aTThtxy892gTiq1FuLt13xC6fta5GOVW09EluhqmubLVMSylKF0FBR712c9wL3IvVVT-iItlLRHiz61OxheWx_WVzdzZFqpOp1sTbOOw5fFMd-Fr_uaCl2loJiG7tRfPho5Oz22EBwMz4QGT1gIAdZXw_N0n_9k70zNDcU4yv2pCbCI9KBaTSF0WmgMX8dHKv1-3wJyhbSGv3_UVRqhER7Vy9lsdvOhXlh8bLiFEMq1bN1fUXOcX0UQTLCOEC7GJYXKryUfxDH27mr0pkenOenZtqEgwHMTAhZ4X3mfFJpfWc3SdG7obRLfH68ykz5OojS6Nb5FPK43qNEZpVD-FuwCCnk7TQzImHE-EcF9jhqkrUzl7U4cwOLJZnu0781BwhXC7VN09Xn8C6I7eARc29p2FIKqRD12kHiNHhz0IKN0d1CXbKLKyVNUNKEtoVSPW6DEW7G8O-YhidEr_ZMfskIPFJqv-s4k1Q9fnSOL_HiQKw-ksZIZMK&cid=CAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgame.gnlore.com%2F&ds=l&xdt=1&iif=1&cor=5078501900436282000&adk=1877897942&idt=133&cac=0&dtd=16

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35b34cf4807b0c825658570973b872c9e3642f088105fca523b692069bc1206a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13979
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 446A 1 KB
643 B 40ms
39ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 15132
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Sun, 10 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame 790D 51 KB
19 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 04:53:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 04:53:58 GMT

GET
H3 200 18337706635704523187
tpc.googlesyndication.com/simgad/ Frame 4AB9 4 KB
4 KB 42ms
41ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18337706635704523187?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23036658725405b74ec18faff686a81a4a4a6fdcf886a3ed9954c133d08f349e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 06:15:29 GMT
x-content-type-options: nosniff
age: 51293
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4515
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 13:18:40 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 08 Dec 2024 06:15:29 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 181ms
74ms Preflight
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 20:30:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DBE6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1

43 B
732 B

100ms
100ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiA4Z3cATAB&v=APEucNU94VHhfp_Dq3-DS3fkrxJZg3m7yN2ivIUcktJ45KfmtieYKoY7vJzOXJrtYnqpMCF9oHegd_0zb2wK2ExS2YAYS8rd9Q43iRTO0chS0WHjthK4CO0iCb_TIkWTQyu2Ll3_gOoE9Fwly5MICzWYdncuidGIQZnlclnspcXMadTO4OvPBXY
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r%2FZ5eh6DQFtASq53CLCi1MCnIUfDT1SQHIh3CJWhmdUabm8WB6%2BYK6GFmmNF2fjtTW9D3F0EGFYHWvwF0A5qHPPxu59ffqfidSuzvbFJqJDe0W893EPDE8c3LhnHGGJnmMBL8svT8N1Rxw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8330016c89a96a76-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame DBE6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXTOXrjyJZrSxKR0doxnDwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1

43 B
739 B

76ms
75ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiA4Z3cATAB&v=APEucNU94VHhfp_Dq3-DS3fkrxJZg3m7yN2ivIUcktJ45KfmtieYKoY7vJzOXJrtYnqpMCF9oHegd_0zb2wK2ExS2YAYS8rd9Q43iRTO0chS0WHjthK4CO0iCb_TIkWTQyu2Ll3_gOoE9Fwly5MICzWYdncuidGIQZnlclnspcXMadTO4OvPBXY
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ULOnrhOOeajEBbLU5nhnWmfKE6kVMg8W7q1KUvQxd5rHLiXY4MYHl6Tk0HPcIITwpqgwh4G13g7T%2F%2B86CtvsBEaBFDFBTGkJlIN8UMiSkN26y95UTV4E%2FJKz%2F4xp19yHLzH%2F6WKrUi8O%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8330016dbc5e6a76-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame DBE6
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMcUt9ItvGcFgH7RC-JuWJ8&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEMcUt9ItvGcFgH7RC-JuWJ8%26google_cver%3D1

43 B
893 B

47ms
47ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEMcUt9ItvGcFgH7RC-JuWJ8%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLbFxQEQq9bcARiA4Z3cATAB&v=APEucNU94VHhfp_Dq3-DS3fkrxJZg3m7yN2ivIUcktJ45KfmtieYKoY7vJzOXJrtYnqpMCF9oHegd_0zb2wK2ExS2YAYS8rd9Q43iRTO0chS0WHjthK4CO0iCb_TIkWTQyu2Ll3_gOoE9Fwly5MICzWYdncuidGIQZnlclnspcXMadTO4OvPBXY

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: 281fdd54-329e-42f8-98bd-771fccc009fe
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: a35bc22e-5cf1-48f1-912a-2b3d10dfeb90
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEMcUt9ItvGcFgH7RC-JuWJ8%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DBE6
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D

170 B
188 B

49ms
49ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: b8e42a76-0922-4d53-9278-dcd18ec85b51
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9927 0
20 B 76ms
76ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoKCAEqBmJhbm5lcgoKCAIqBnNlcnZlcgoNEBQhAAAAALBM_0AwBAoNEBUhAAAAAAAAJkAwBAoNEBYhAAAAAAAAEEAwBAoNEBghAAAAAAAgmEAwBAoNEDIhAAAAAJqZyT8wBAoNEDMhAAAAAJqZyT8wBAoNEDQhAAAAAJqZyT8wBAoNEDUhAAAAAJqZyT8wBAoNEDYhAAAAAJqZyT8wBAoNEDchAAAAAJqZyT8wBAoNEDghAAAAgJmZ6T8wBAoNEDkhAADgzMz0i0AwBAoNEDohAABgZmaOjEAwBAoNEDshAACgmZmnk0AwBAoNEDwhAACgmZmnk0AwBAoNED0hAAAwMzOpk0AwBAoNED4hAABwZmYKmEAwBAoNED8hAABwZmYKmEAwBAoNEEAhAAAwMzM7mEAwBBIaQ05HSXlZNlpnNE1ERlk1ZkZRZ2RKVG9KTXciCXRleHQvcnl1aygV

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/d500f8b303efba9f5ab695bab8da4c89.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2885
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1

43 B
769 B

99ms
99ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COmR064CEPvCzOgCGPTP3d4BMAE&v=APEucNWWxRFNgNRGPcq68pYS9WcfLRqcrlxUXH_kxGSdxqMjfePlepluOZEi7-vJBV7TmZHKhIrULS33LTOppSiCoS-Ff7TxdoZMWsat6ss3AVwiJl13i9nHOYmz8L7fCaZDb-maErE07wlITLHEzjgNVYWp7QIPeJUINxJQbO7EgaQO_h3SJEw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RErZZH2rh7FejYvQPNGsxnkVoroI1l9Qi6jmR%2Bxhv5vW1SmGWubUfYQAVdz8GHW1jtYGwBoPo4JZqoaCLf64IhkvNvvIzD3IacjLzHLQxkNM8cjXQcCCMFJYxk0HSTL%2By6RFv1OIjQSrAg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8330016c89ae6a76-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 2885
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZXTOXgRXlgKDbLDIThK3awAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1

43 B
736 B

89ms
89ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COmR064CEPvCzOgCGPTP3d4BMAE&v=APEucNWWxRFNgNRGPcq68pYS9WcfLRqcrlxUXH_kxGSdxqMjfePlepluOZEi7-vJBV7TmZHKhIrULS33LTOppSiCoS-Ff7TxdoZMWsat6ss3AVwiJl13i9nHOYmz8L7fCaZDb-maErE07wlITLHEzjgNVYWp7QIPeJUINxJQbO7EgaQO_h3SJEw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UgTff2VWDBQyqGeAt%2FvjwYLpch7e2gJvwYGzqafM1UuA30UsoIr6FrZh3QvuK9hV5zrpNFvkh%2FA3lFblSxjozVJXO81uZBctRVV8wKm2Th3%2B7Kbrfkp0lzPeYyyPWYv%2BbPjfAKgF1k%2B7wA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8330016dbc596a76-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEAqrsdyOl4Hf1elUqkU7Its&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 2885
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMcUt9ItvGcFgH7RC-JuWJ8&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEMcUt9ItvGcFgH7RC-JuWJ8%26google_cver%3D1

43 B
892 B

45ms
44ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEMcUt9ItvGcFgH7RC-JuWJ8%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COmR064CEPvCzOgCGPTP3d4BMAE&v=APEucNWWxRFNgNRGPcq68pYS9WcfLRqcrlxUXH_kxGSdxqMjfePlepluOZEi7-vJBV7TmZHKhIrULS33LTOppSiCoS-Ff7TxdoZMWsat6ss3AVwiJl13i9nHOYmz8L7fCaZDb-maErE07wlITLHEzjgNVYWp7QIPeJUINxJQbO7EgaQO_h3SJEw

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: f271c850-3494-4e4a-93d9-f18f9a197823
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: 3fda3da5-394c-4b07-b50e-e3a50399da58
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEMcUt9ItvGcFgH7RC-JuWJ8%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2885
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D

170 B
188 B

50ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
an-x-request-uuid: 366bbaea-aa32-4a19-9cb3-ecb08ac23dfa
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTAxNDI3OTIxODUyMTEzNTA4NA%3D%3D
x-proxy-origin: 80.255.7.105; 80.255.7.105; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame 593C 51 KB
19 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 04:53:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 04:53:58 GMT

GET
DATA 200
OK truncated
/ Frame 1D5A 204 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b13595e9081cd415ed322ae7542d97895aea6a8fd0259c9f49fdb0e3678e7a6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 1397 15 KB
16 KB 39ms
39ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 23:00:11 GMT
x-content-type-options: nosniff
age: 77411
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 23:00:11 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 1397 15 KB
15 KB 44ms
43ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 15:16:12 GMT
x-content-type-options: nosniff
age: 450850
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 15:16:12 GMT

GET
DATA 200
OK truncated
/ Frame 9F17 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6c10001739e1e08beca68abef5fa8d56fd42d09f3e19151134cfe3c92823dd84

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 9628 38 KB
13 KB 40ms
39ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 60274
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 3D49
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOgOZ7s2G_0Uh3p8O_zqSE4&google_cver=1&google_push=AXcoOmTdx2Hn_ys28BHq2L7ZsmWDlVHA6anfRX3S7GdDf0SAKjSG-QSVmn...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmTdx2Hn_ys28BHq2L7ZsmWDlVHA6anfRX3S7GdDf0SAKjSG-QSVmnHShI8At7P12S-QzJmCsa4kA9EBcoeoZZnUO3qIoaBa&google_hm=QZ6uVeczFWCF...

170 B
232 B

49ms
49ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmTdx2Hn_ys28BHq2L7ZsmWDlVHA6anfRX3S7GdDf0SAKjSG-QSVmnHShI8At7P12S-QzJmCsa4kA9EBcoeoZZnUO3qIoaBa&google_hm=QZ6uVeczFWCFkKfzSU7N2g

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmTdx2Hn_ys28BHq2L7ZsmWDlVHA6anfRX3S7GdDf0SAKjSG-QSVmnHShI8At7P12S-QzJmCsa4kA9EBcoeoZZnUO3qIoaBa&google_hm=QZ6uVeczFWCFkKfzSU7N2g
pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 3D49 0
104 B 282ms
126ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEI6Z0Wbhp4f-g2K1zz10i8Q&google_cver=1&google_push=AXcoOmR2QM9-zRU5iB4_nx4krUvJOxafENzIgu_DMXMieWPwKMaWO4-czTu4c14Y-Q77QaTbI5yjPB65P0HR4XprPfg71e4rO9M6
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=294567026&adf=1407713105&pi=t.aa~a.218775750~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=1541&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=13
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D49
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGKuoyv92S1Q3ziC3bmUYZE&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEGKuoyv92S1Q3ziC3bmUYZE&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M0tLOGVZRG4xUmMzWFU1&google_gid=CAESEGKuoyv92S1Q3ziC3bmUYZE&google_cver=1&google_push=AXcoOmSgGNGgr2yBW996YQyCtFlrBDcdnrO0_ahq9Y-jKg_...

170 B
188 B

48ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M0tLOGVZRG4xUmMzWFU1&google_gid=CAESEGKuoyv92S1Q3ziC3bmUYZE&google_cver=1&google_push=AXcoOmSgGNGgr2yBW996YQyCtFlrBDcdnrO0_ahq9Y-jKg_U2WMfCMXA07f-mkAt2_opXTPI_TsYywN5gYSY5Yo0q3Y5kMkrMUnj8Q

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 20:30:22 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-0f7f5cc7c951f6e61@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M0tLOGVZRG4xUmMzWFU1&google_gid=CAESEGKuoyv92S1Q3ziC3bmUYZE&google_cver=1&google_push=AXcoOmSgGNGgr2yBW996YQyCtFlrBDcdnrO0_ahq9Y-jKg_U2WMfCMXA07f-mkAt2_opXTPI_TsYywN5gYSY5Yo0q3Y5kMkrMUnj8Q
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D49
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEA2Tlk1-9Ese6kjZOrwccMg&google_push=AXcoOmRy05ezL4aZsHWHq8YZIu9S0hnwGPoDh9R5nuMOcVbF3ji2Zagfdo...

170 B
188 B

49ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEA2Tlk1-9Ese6kjZOrwccMg&google_push=AXcoOmRy05ezL4aZsHWHq8YZIu9S0hnwGPoDh9R5nuMOcVbF3ji2ZagfdoNT-l3F3_f_W6Sqt_r4foI6ysVfbYRXgzjY6WOpfwg0EQ

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230082-FRA
pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1702153822.236507,VS0,VE94
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEA2Tlk1-9Ese6kjZOrwccMg&google_push=AXcoOmRy05ezL4aZsHWHq8YZIu9S0hnwGPoDh9R5nuMOcVbF3ji2ZagfdoNT-l3F3_f_W6Sqt_r4foI6ysVfbYRXgzjY6WOpfwg0EQ
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D49
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEPyDz2E1G5-JRAA0DI8TDTo&google_cver=1&google_push=AXcoOmQJe4BF9O43mELqIwAuHO7wteXOn0d5MJICFeJbjLqe81xcaFi2vRJ_yZbRbt4YJJbucMOpITqfAzovXmtN...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=poKskkoBRycG4RNxUnWo7A&google_push=AXcoOmQJe4BF9O43mELqIwAuHO7wteXOn0d5MJICFeJbjLqe81xcaFi2vRJ_yZbRbt4YJJbucMOpITqfAzovXmtNPA8Jxv5oyB3RHQ

170 B
188 B

51ms
50ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=poKskkoBRycG4RNxUnWo7A&google_push=AXcoOmQJe4BF9O43mELqIwAuHO7wteXOn0d5MJICFeJbjLqe81xcaFi2vRJ_yZbRbt4YJJbucMOpITqfAzovXmtNPA8Jxv5oyB3RHQ

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=poKskkoBRycG4RNxUnWo7A&google_push=AXcoOmQJe4BF9O43mELqIwAuHO7wteXOn0d5MJICFeJbjLqe81xcaFi2vRJ_yZbRbt4YJJbucMOpITqfAzovXmtNPA8Jxv5oyB3RHQ
x-host: tde-deliveryengine-production-5989b845bf-wvhgr
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame 3D49 43 B
146 B 128ms
40ms Image
image/gif 35.156.190.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEog0NnvFTW9pyK3W5nFLI0&google_cver=1&google_push=AXcoOmQwrIDtMSoY7mYyR67tEQdouafkT7gdeoHmrkthKD4NklbVkWnqryUxs-nkacNVqHFGsicyxxXRrMsFIi3gk0GkSlnr5UxZmA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=294567026&adf=1407713105&pi=t.aa~a.218775750~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250&nras=4&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=1541&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=13
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.156.190.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-190-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D49
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEGUqOFtcEcvKBs3ojGkIyNw&google_cver=1&google_push=AXcoOmQ5upA3kuOX1kJOtIgesTDE9pny0xApcTM4q0uB5kCHE2xcxQNEkZKJzKcmG5C1UD2rDwvuJHqMslyxuNSjZcAsjrK...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ5upA3kuOX1kJOtIgesTDE9pny0xApcTM4q0uB5kCHE2xcxQNEkZKJzKcmG5C1UD2rDwvuJHqMslyxuNSjZcAsjrKvdaRw&google_hm=eS1kSGc1NWxKRTJwRU1yQk...

170 B
188 B

49ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ5upA3kuOX1kJOtIgesTDE9pny0xApcTM4q0uB5kCHE2xcxQNEkZKJzKcmG5C1UD2rDwvuJHqMslyxuNSjZcAsjrKvdaRw&google_hm=eS1kSGc1NWxKRTJwRU1yQkllX1BhRjFoUGkzeUxSUGk0Z35B

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ5upA3kuOX1kJOtIgesTDE9pny0xApcTM4q0uB5kCHE2xcxQNEkZKJzKcmG5C1UD2rDwvuJHqMslyxuNSjZcAsjrKvdaRw&google_hm=eS1kSGc1NWxKRTJwRU1yQkllX1BhRjFoUGkzeUxSUGk0Z35B
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 3D49 0
40 B 47ms
46ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ImHGpPrgxlJvxcGuYJkwbdpec_yGCz18mie4jvrEaKqt-Apuwi-SSoHakEPgV7C4g2_eOW

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame B65D 38 KB
13 KB 40ms
39ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 60274
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET 5w3jqr4k
sync-tm.everesttech.net/upi/pid/ Frame 4962 0
0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 4962
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEPlQu53P_INPLgy18ulL6Lc&google_cver=1&google_push=AXcoOmSFoGEGEst4X83EIv5NT-_23-Fh2ONExTwxBlfoSS-EFKM21Z1c_0r4E7ibgFDOpCo16lpkVEkz4AMtBgbVgJk6O0xaGV84MA0
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C33A1BCE82AC4F94BEBAC736CEBA73D0&google_push=AXcoOmSFoGEGEst4X83EIv5NT-_23-Fh2ONExTwxBlfoSS-EFKM21Z1c_0r4E7ibgFDOpCo16lpkVEkz4AMtBgb...

170 B
232 B

48ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C33A1BCE82AC4F94BEBAC736CEBA73D0&google_push=AXcoOmSFoGEGEst4X83EIv5NT-_23-Fh2ONExTwxBlfoSS-EFKM21Z1c_0r4E7ibgFDOpCo16lpkVEkz4AMtBgbVgJk6O0xaGV84MA0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C33A1BCE82AC4F94BEBAC736CEBA73D0&google_push=AXcoOmSFoGEGEst4X83EIv5NT-_23-Fh2ONExTwxBlfoSS-EFKM21Z1c_0r4E7ibgFDOpCo16lpkVEkz4AMtBgbVgJk6O0xaGV84MA0
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 08 Dec 2023 20:30:22 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4962
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESECHKZVuyPLOMTBrN6TdNWEI&google_cver=1&google_push=AXcoOmR6qziqmVrX5t7Za2Z10oLRDESz2XJsbE0pGu-XROOdy0Do0DpqQk57J9JSZw_uBNoTHWU_8bZ0Q13ScXWD...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=M2ULawEbTp85xKV-XHqBuA&google_push=AXcoOmR6qziqmVrX5t7Za2Z10oLRDESz2XJsbE0pGu-XROOdy0Do0DpqQk57J9JSZw_uBNoTHWU_8bZ0Q13ScXWDJOfy5fqKJhCT-jQ

170 B
188 B

50ms
50ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=M2ULawEbTp85xKV-XHqBuA&google_push=AXcoOmR6qziqmVrX5t7Za2Z10oLRDESz2XJsbE0pGu-XROOdy0Do0DpqQk57J9JSZw_uBNoTHWU_8bZ0Q13ScXWDJOfy5fqKJhCT-jQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=M2ULawEbTp85xKV-XHqBuA&google_push=AXcoOmR6qziqmVrX5t7Za2Z10oLRDESz2XJsbE0pGu-XROOdy0Do0DpqQk57J9JSZw_uBNoTHWU_8bZ0Q13ScXWDJOfy5fqKJhCT-jQ
x-host: tde-deliveryengine-production-5989b845bf-82dq7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4962
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEEXg8Ai6rPZzLWrljHuFWoM&google_cver=1&google_push=AXcoOmRAdiKTWzEmRDnhsnD6RYuRx1Q0P2FZjFUoX61IHgZud71XOR16oUxK-JqDDSu-2v5xZh0MO9AMg2ZLHPOIGjLD7h1...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRAdiKTWzEmRDnhsnD6RYuRx1Q0P2FZjFUoX61IHgZud71XOR16oUxK-JqDDSu-2v5xZh0MO9AMg2ZLHPOIGjLD7h1IHwRGwQ&google_hm=eS1HMU42ZFkxRTJwRlFp...

170 B
188 B

50ms
50ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRAdiKTWzEmRDnhsnD6RYuRx1Q0P2FZjFUoX61IHgZud71XOR16oUxK-JqDDSu-2v5xZh0MO9AMg2ZLHPOIGjLD7h1IHwRGwQ&google_hm=eS1HMU42ZFkxRTJwRlFpbmZfTXJnOXAuemwxbjZocjNfWX5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRAdiKTWzEmRDnhsnD6RYuRx1Q0P2FZjFUoX61IHgZud71XOR16oUxK-JqDDSu-2v5xZh0MO9AMg2ZLHPOIGjLD7h1IHwRGwQ&google_hm=eS1HMU42ZFkxRTJwRlFpbmZfTXJnOXAuemwxbjZocjNfWX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4962
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEASqQPPD4hsBjOVOgh_Yy2w&google_cver=1&google_push=AXcoOmQjru9Ef_1Gzzgfjh325kIeVLKnQx4VKVBkN_ox5T7amtNCN_9STmCHTTHy_AxMgkAH6WSX4X-6MMWYuwdsunD6HNn...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEASqQPPD4hsBjOVOgh_Yy2w&google_cver=1&google_push=AXcoOmQjru9Ef_1Gzzgfjh325kIeVLKnQx4VKVBkN_ox5T7amtNCN_9STmCHTTHy_AxMgkAH6WSX4X-6MMWYuwdsunD6H...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQjru9Ef_1Gzzgfjh325kIeVLKnQx4VKVBkN_ox5T7amtNCN_9STmCHTTHy_AxMgkAH6WSX4X-6MMWYuwdsunD6HNnk5QVEwQI

170 B
188 B

50ms
49ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQjru9Ef_1Gzzgfjh325kIeVLKnQx4VKVBkN_ox5T7amtNCN_9STmCHTTHy_AxMgkAH6WSX4X-6MMWYuwdsunD6HNnk5QVEwQI

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQjru9Ef_1Gzzgfjh325kIeVLKnQx4VKVBkN_ox5T7amtNCN_9STmCHTTHy_AxMgkAH6WSX4X-6MMWYuwdsunD6HNnk5QVEwQI
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 4962 43 B
363 B 123ms
39ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQ-YSt1KEX-u0yvvBdVj5Yls0y233hTFlCQgu4gvtz6TZiYjXXFd2EnTA5fXbQNvlMz1zCuPzIgvbMno_iFXLD-IkjWJX5aPm4&google_gid=CAESENPKgvviI6-fltYdoxvA8WQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:21 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 240388
expires: Sat, 09 Dec 2023 00:00:00 GMT

GET
H2

200

report
sync.teads.tv/um/ Frame 4962
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEMOrWbUgb0wU...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmRyzMP1zAgdRgFXxgZttuXosbuZm8RLBqLx9UvFiyto9ANMOCfrO7yhYS8UnNNeCy-knK9UCKzk_MrdAqUZdTPzHcp2etUoTTJ9
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

88ms
85ms

Image
image/gif

23.43.61.33
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19
Protocol: H2
Server: 23.43.61.33 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-43-61-33.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: Sat, 09 Dec 2023 20:30:22 GMT
pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 4962 0
49 B 47ms
47ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I28tQfQVTPgwurCfW_juvqUXtOJBxfFWJJAVbV2J3JYqKCxnziqGdXF_Uqir8an7O-KgH8mQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 102ms
74ms Preflight
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 20:30:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 1397
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CdtbJXc50Zca-GIDJ1fAPmba48Auzx7CjbpPq_duUDNzZHhABIIzqln5glYKAgJgHoAGumIqiAsgBCakCYi2If_cOsj6oAwHIA8sEqgTmAU_QhdkgAU45l9wF-4yDJTaqp5q_cuSCCAjAMgl...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213071060372392050252%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%2...

0
0

74ms
74ms

Fetch
text/css

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2213071060372392050252%22,%22debug_reporting%22:true,%22destination%22:%22https://xcraft.net%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22608341038%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2212788616612280573281%22}&andc=true

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"13071060372392050252","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"12788616612280573281"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 20:30:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"13071060372392050252","debug_reporting":true,"destination":"https://xcraft.net","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["608341038"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"12788616612280573281"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4AB9 221 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8399f39a319a3e78681f54d5493938c69a82598ca890fa427ddebf3ccf325166

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame BB16 41 KB
14 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CwCA-rucEqZRiDSBYR79qWRR84hx-hGOLhv6aZPNLliwIJnThB6fXzzCtp8qOK2W55f234dvEniMl5CCjEm-TAxJlfpwzPdPHRgXzSsniQo6PeGcoKH236Vu3dlEPvG1iQFkeEdUZMVSGswz9f7K9SKKOqSDJQtrUGd23y1PjzisgQYLE&cry=1&dbm_d=AKAmf-AgOsEATvLsVQXs9AhJ7h3rIGRjDnQJAg6Gx8UNw8iY2Hri0zd2uHJKZDi5o7DzwWFruiYpYn-5oK67qSIxpuBvqRtBAYEvnwqBIHhhlQRHhNIeIjzBI1g7e0mN1fwybYPL3LCkUHUTGIUVF4LUTwpVHoQgTNuke1RRFKzwmfW8DBE2GbxiPxJ36C9gZC3xaTrPMXku_3vt3BP018QUSOJAPsfwYW-rk1E0nvGdBy_s16fQPEkQiUSILbhU3gvr2CAHT9S9_-MAoW-_hi4-WfjZZWlJTmyHzA308ySiBYlJP-eqcLN4iKONToWGYQ6uziuPgCkOuNgM2DJq9TL3kkJn0Qx7bKtgd6kMkkhQM-pusJNJPQCHaKKBrz4wGk0Ix7Ligq13_PWwwQLuu1qXOLoXykeG_ydYLBxJKlUs2Pz5ULyniZM7rZ2NPxb2z6uwGOq9dTtZlrXQqjdLfZtwWY0RvOgguV_fc9nZtVYJuZ-auyzbua0NxreY-R_st--40o38o9fRUv4BS5HZ_kKRk06sdXoxawJmJ3CJ_5E6rjSLQ35licf-GSrgd3vDRKTSDdY0NrGxFOiJA7K4A5AvN-ldabUdjWScvACHyRynT7ovyM1otuGzBZsSAY1SSgQtQbTK9fPQnBhobFUdDQRPwua0jjgad4Qn7T2i_XZ74Izy8dJUHO-d48wljGWC15zn5olouGATfAJK_By0GXBTdAZpZdR2LsgDJ8hhU-9kmyLl-3pSPPGg19E6qUV_MCFsKbZNq2h7Qy7PVHnHAAkCFXkGIo2hPaS7aI2XHjUvvAF1L-qfPLcfkkEcju1MymCArFIsCqaAnM-csIocXeGsCcM_Vk-npJi_kMbDnTeZlE1Wt39LCCRHNQnmHCLWfHwg7WBHCmuwsgYU_Sq4TzoaUDgkVj-nbnO96tIAb6VIRftCEz_hDlarlVExs3OkKlh0XZbQQqgs7XHx7Ydh016V8RFQMbjvYm8tRcLmR7iBZwMP--UBZCFvyfj08qxlJsWTMktgAOE1pf6dLk0TdLL3xk2EmYX4tFUffs-tiZgvJDdei-qaP0JDEhpm00RzVz7zpnfoSGEoiEK55jsUxoFTpZzSBqT2ThFgRn1uFk5ktX-9OCGIaxDapIFR2f1ujME_cFV5Hk6Bl0ZlfkW3FVtaHjKSNJGyAaAQmAJoDYnmEmlYjSPNL-vwRctAqgvQRbmVoLGEny4ELO9Qr0F46Wijv7x1eQDloIGQBOBhna4R9a3Av-iYoS5bDye98a1ffChLqD_nGSk6RfMmXTFaFzUk7dAx8S1asMtxRQZ0DXpyMkEQFAcpCmyqq9sSPkyU_MPC3pEoaB5y8eoBotUIdmL3xRy_FNBl97DD9QDHdeZheiMcZfHkykr2IsyYqblsEeTePfUnFqAM_w7lOLUg4ITHq_SrSv5AIQfgihP6sRYqyzHKNu2vDOaCN7m1Eag11R4ROjp6kAytrL8Q2gpGlVbADvTMXXx-MYwXPwE3hYEhfJfN4lOsV6wJzCt9NFTPbIq-e91gFueFUmqZUa227JtXH7CfYLjugy6M3T-GHsU0kdf097_jeyvH2RiJUFnnMXTRrUTPkh1h32KAvT5pXyZYxF0mvENaH8w3toeKR4xHQMV-wjx13QVanOk3WgDPGZxcBqrbrKCoxZQxqAuO4GbzJpgqleSXyIJycGxPPEXFyJZGp6Yui4UMlvOn6V6q51nlpAcmScLIKC4JPGKVDZh_iAxIJj74HSPXaKNWCDdYkfv_RZSU-XvcsslDEwYOXdgLp2Xaq2vmn1fyfCtHaYxxYAJ8owh1h4yT7tLxRk2P5D7exYSryJXVzVSDXJO0gNl9M_MYBi5a5Tys-Xph0UzM3MFJ5eIyGjcvymS7P8KEZgqQP2o1lrw0INKMmfgVJf_QH3P4Mmd_TYaBX8iDuF5kcZfnSiWeQ_5gUHINa8iF121rYckgtFaNPwysfAcHmI57wNzZ-gc6_Lm_16kCibz35Dj-I27_GJ-AqtLa_Z9NIOC3gDetLRr9vXAW_efDzoCJyq3JZ5kNYSjLQsAW1-_NRk3Ksej2C6Abb-f--9q1ylAujYk1v_InicTgnXLQVODBYGb7fjqGNCawrvqu3DNWMFntAteK-nNJPrn3Pidsrl_ZiS7nPo5_gxwyqSlFHyA47VJK_sfmcmHU1Sdo3fDcGIaNKaXTeUmsnrUcPUsXDG0mlL2h-Wc600Kuz7-5IEsNQhbJ81TbBye4tFUUm4RVlqZOcHMxY8g8EViaduUGJmBHa0C29qCcZNARSahp0xIVoh75Um0Zf7FbaqmMbHybCchzPEHLcOyUICyPG28yvZmTb2CP0Ft6O7MW0FKfFc_kkMU2KMaE8Frl1-vEj9oURwQcqdAXsWZry7j0yIM-NWPlct6qGfZ3wGjXRR815dmW7RKesgU_EuBAdwjHkNihwRSp8yI2FRRz-hhC0BB4rs481vcHY21Ts0C8vrof2g-1wmyAuqLf0giW1o4-3gsUoGsBuPddE0CKTpd2mhlOSU5RZLek4mbo7B9w11jIwLndo8zvc3w9vY5YD_RrUj9gAK-cOUmJj5ARO-pHhtZpHY7eSSRmEUprpzk7kxNdYPhAlZvcMlcB996DD_iSywtgw9bcUO4GCcDaKdYc4xsb-7zKvjlfvZw3lJxhBnXU_jSRG267re9xUQQzKGCGTLYuKw77aF9tYxwKQDqN8uMRd6XhtJzUqdQhyXBUSMx0nPDwGlsCji6jb4vAVfIM5griqUsda2T_i-A2QkxhCaNM7sKEstDt4JY_MbZcrfIR9MbNHqCrBsjSHxIQiZTLULa8g6vBMMlkIibzoYegPVnichjFWYOFLV1drs-tokjnaiix7yogKLDYGhFie93m-0qT83WwOBHbuFRIV3jUmEkqk0-_K1mu1OkisTrpPP_sIgzazQVVV6Jc4YpOxg8jrpJ2bd1rfyX1Akf45ygBJcLVCAed8pbAODZxlFscWpRsOc-uzjbxdCh1xMCK950V8Ks9dBe0mUQDTRcnOihkKxK9X0PSCpuNvXz_jhZkXwiwquJzgv9wNGpWNp5Ce_NcD798IzQAduLXLRKVd438FPYBzymMV3Z1BEWjRq_HF9FOsekrqpglbxyAhqtw-QZ-wjTQ3dFZSG_C_kto9Iu9e2p9OmtvGFwFVAn2sQBa_y_OhK_Cs2wxog_K1sh1Z_NmgpGaSNttLcxPduISg3LhuxAWuoYyGpDSP3NxoWfDCX81UIFaM0WXV6e8Wrz4D0dRaf_aTThtxy892gTiq1FuLt13xC6fta5GOVW09EluhqmubLVMSylKF0FBR712c9wL3IvVVT-iItlLRHiz61OxheWx_WVzdzZFqpOp1sTbOOw5fFMd-Fr_uaCl2loJiG7tRfPho5Oz22EBwMz4QGT1gIAdZXw_N0n_9k70zNDcU4yv2pCbCI9KBaTSF0WmgMX8dHKv1-3wJyhbSGv3_UVRqhER7Vy9lsdvOhXlh8bLiFEMq1bN1fUXOcX0UQTLCOEC7GJYXKryUfxDH27mr0pkenOenZtqEgwHMTAhZ4X3mfFJpfWc3SdG7obRLfH68ykz5OojS6Nb5FPK43qNEZpVD-FuwCCnk7TQzImHE-EcF9jhqkrUzl7U4cwOLJZnu0781BwhXC7VN09Xn8C6I7eARc29p2FIKqRD12kHiNHhz0IKN0d1CXbKLKyVNUNKEtoVSPW6DEW7G8O-YhidEr_ZMfskIPFJqv-s4k1Q9fnSOL_HiQKw-ksZIZMK&cid=CAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fgame.gnlore.com%2F&ds=l&xdt=1&iif=1&cor=5078501900436282000&adk=1877897942&idt=133&cac=0&dtd=16

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 95114
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjE1MzgyMjA4MDcwMgogIHNlcnZlcl9pcDogMTI2MDYxMzUyCiAgcHJvY2Vzc19pZDogMTQ0MjkzNjg0OAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame BB16 0
597 B 78ms
77ms Image
image/png 172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMjE1MzgyMjA4MDcwMgogIHNlcnZlcl9pcDogMTI2MDYxMzUyCiAgcHJvY2Vzc19pZDogMTQ0MjkzNjg0OAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMzAxODAyNTEzODA3MDYxMzMzMwpkZWJ1Z19rZXk6IDE4MzcyNDY2MjIwMzYyMzg4NjE3CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyMy0xMi0wOSIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMTc1ODk5CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMDcwNjcKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2FkLXNydi5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9rbGljay13ZWx0LmRlIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x3c7edb9b0b5989490000000000000000","13":"0x8aee6954da046a1a0000000000000000","14":"0x7c31c841f080dc7f0000000000000000","15":"0x7b52d51cd6169c880000000000000000"},"debug_key":"18372466220362388617","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"21":[],"8":["11868943"]},"priority":"0","source_event_id":"13018025138070613333"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame BB16 11 KB
4 KB 130ms
39ms Script
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=&gdpr_consent=&rnd=1702153821405700&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC49SBXc50ZcThGKaC1fAP-emvEKblvaBprZWcp8kP8C4QASCM6pZ-YJWCgICYB8gBCakCYi2If_cOsj6oAwHIA5sEqgT0AU_Qtonc6MgcjJe1DiqUUgR9s7XxVvT21QF0Dj0vetL1j-E4vmcME2_rXv9v91HmIwfIWfPzzfY-BrVm43NMKJl-igGpLeVI53NgnXd3s9vTp7vCrUmoKwVUPtoMpD-YVMFniSnuotoiksIWyDXg6fd_QdYDBFGEwNQm1N5f2jj1QKV3LZd4LaqJNL0D85YOybHsEfvthn7g-vnKnGo3RmglgX812yVrmenKW4M1oSgcendI-nKlE9KrIDktZXsB5xhY07UU7NSNwL2NbgNjPlmeC2z2NBo-a4zSBn3Gr1fQ-VvRylcKsNrUuXFCASkksZ74bHLABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYtOKCj5mDgwOACgGYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB%26sig%3DAOD64_2vFgcAiqvR5lryku98cOn5AMfedg%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-BiXpH6QfzlnUzjj6GaDXauxP0YT_mooCiw6hw9MUAjLt-l8OZWWBRQht9WQAOFnpjpfEwlriEH8LYevd2Wd6qTnbac8wVsQ-7Rb_GHrn_9BcC2m3uOvAqyshSpH1HHoygGq9yHeb9sRYHeak6lk-8SKQxv7zf3QUmA8fEXS7qUYmcOSBI%26cry%3D1%26dbm_d%3DAKAmf-DmqDrg0Yosop6hItrqFwoLRi6L8te0NWMKEUiPHwpYBwpOUSgu_mOHpFjjKebrok08D-oDDSLWL75XqkxMSJu0pM-g26hUQU2S4j2CKDcJ1WSgdgm-0XHykbTE375driNSAKYQfpK07HaKJPCV_HLo_CMT5xFImDqZ3mTqMPII3Vq-2GJhYPNkUpOYTlHza_TKtyAga1Acffl0ZsoFpfsbfyD5a1q2EvmYDMMTFi_cetRwJ8OP0PIFT8CFmiKJ-xoPkUiPV60-8GAW_7E28Ipyd--tAECKem2F4KOUaRM6Ko6eSo5RTlJyAc5PyfzRpCnGoEcsVqcamZrX-E7SE9rgNvfYYR9g5jS-j47nt3x-CnYuWFkhTKUDkdr_nM5VegVSSHUZ_RMLXzO56i82--6XzZDeZCGlBR073Wo5XZDPDdY5T-fUNd6vq_28n67G22DJeWBI4LMEig3xVcuOAtihMN2phFbIEtcpamJTFallCTrSzWLHXV76k10mpj0yhMoRuhYvCU9ni9RU9Z6A2HW-dOo2zA%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e12c1b8253b1c052b5421a54f6b2d642d70cd713f368b571048c40fb3c09cd89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Date: Sat, 09 Dec 2023 20:30:22 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4140
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame D644 51 KB
19 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 04:53:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 04:53:58 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 1D5A 0
0 77ms
77ms Fetch
image/gif 172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst9fHh4ng8Kl3xRhi74zC1sEk1yZ-R5k_-pwxAspIoWfuvl7LoSp3UKSSzjSFXTi8KqHXBFNuq9hX87Kd5wyPYFBhTCpznWnl1EdTzsXK1OiXDRk8YhftNe11d6rhG_Q6a3zGrZjrORN8NMeO1ewfAkRpVlsZhHZrtwpmluNuOZW_pT0nEtiqBXjNu3tDIAbLA1EnXdJIm8whZv9bw0Gg86b2NrXJFfYHHTJXzyEA8AvkqcoHfiIOOyTdhPNkkPeAFRJDf8_i9VESmgXhVXJalgLHgWL8rLfa7oTVagZGnDZl6LOIe3lyz7WsSa3MaxLGs2WD_rJtNDWfpwEpAMkrYxbAZszVaqfwSBR_stsPn6BkLhtYebM1ZIk4p-Rgmg6rJdXtRKO-YWo636JEfspO4qUlUx3zGlYAYPhUG8UH_OiknROZrPCWgd-kBHiEGwJm8Ons1xzojvgwmjzmAPxUeVTQRAKF4xip__uQDMe_MkLmzudTCYFpEN_yQlF1EM_OKp_0CY-nMXjSbua5JKlwQEfYAJs6hOqCYGEqBNnx840sY6HR649wWixhcxGsHEEM_mTiQvTTENGFbFh0p27uBtqN-F09TKiaoYdWagyHTEBI7qyR2-op_-n4Gf_VUoN_yDGyT2F-RepJzwO0R3KYZBSU33sMQt9M_WICtEFG_mG0FRtzdNfRJ3JbiodUwgdu_HYBbh2FC2DRjcQoTepPwZ8iPVWdeGJd15sdCy9FogNUfhS_5XhrjyImTzMnqGB7u_9yogo2YCB0jfJYrSLmQ9Rbnon9upSn-w2t5ImLSbn9Qx1virOn5mgN98qAlB06duu0M8-DJScXXAgvJ4AF7wscmqmAoxt2Gx3BdUijO91wT7bRWibsVIDSCuTtdqkysWfal-LFDIkTuzVRmxiUKBDNBDOnNOAc-EY3b2SschgUtjZ-IcQGe01pd8hx5UCiDRS5mtv4hqq62mig469Q0SDBx1NaWNuP946YmMgOjS7b8i2_3eJGHpNsjN1u4UKMjO1mAzRuqtkM8TscRDN6I5bOPKtyJRsj81LFmjOSTvNj0wb1i5Dggb3efssflnL90LJjhZG2u4cLGpOP3ARixKjeSOjVZsGx1TMf6icXPtvTGH4Hm_UZybwJwKAjhNj3ZWuhbHge1Gti0EkIjbK8-0MCeMiU3UL5I2fhVKE5q0K8d7e7W1mH6jjtQBs0iJN2cU8BcGkaIl6LDbabkTjzci3VHUSs_1u0uj8rhnHtKohmYmoevDYqOCBI2-NGgxYXwA93dt58CyMlWnjGsVj50ZDkCu6FnQB_rqxFpELrmFP7dDHDKURmbaRVnTVbmd4DA15U5F2_uTgKCh5vOyGcP82qUJczytDwCQBA&sai=AMfl-YSCL2VaRDzhf6EVS4X8JEYsdffdm3X8QTUh-yoDtdAajbFV4dGcBYpiAabvIKO6vN5WLBpZxF50Om9lrMJWepNfObd8NgD9S1k2QAP_GVwP_Ew6GTA3EmrhGqFV3Q26rpP4mWvah1uNTGAjOCXrEMz1_OD_1f0j9YUu16lAWOir9AH40JSM3iF8U8Ak_WgyDW9D32SCTdW6TereVTwIKZfiI5BFUSKC_qJnF9CzWQzFXseUw-BvZvXcNDD-9kv5AtCfCsSkH8j6qjqV-3YrNQt4q5zeWp0fzTeoKoAKR_aABzghjq4mpxARDLMiLtd-3nd8KHTbBTJC7RV4uorwUPxEm_kR-7lLcaRvn4aYjgKhxElTZSe7v0zNFgRl24brcftl4G6euX2VXCoKRvQIVgCOJeog3R-NZFx0963xc5U&sig=Cg0ArKJSzOP1RuN9z9VIEAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9maXZlcnIuY29t&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=235&vt=11&dtpt=234&dett=2&cstd=0&cisv=r20231206.34554&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 446A 0
103 B 188ms
126ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEHtvavnzHKUdETtzgC3uUWM&google_cver=1&google_push=AXcoOmSjfZ4WdAhv0FS-NYyuWjcp6y_o9rY-hRRNR9b-YWWgk1fn_lTAR7OFLJwqc9bB33ZYoSkBwM65DS2KRYIIPoKS5SwN9ITAsBk
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=544349898&adf=1397456241&pi=t.aa~a.2282482148~rp.4&w=333&fwrn=1&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=3&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2054&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 446A
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEBFMe-F0CwgB2Gt84VzKWdw&google_cver=1&google_push=AXcoOmRPknifrRqIAKFTzT8YReF06rX_sVu2Tje8Y3E9ong2tUh_okO7kKL_P2rM-Xi0wK5hTtnEjXfiVKJnvUUN7l6j6pV02Ry2IA
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C33A1BCE82AC4F94BEBAC736CEBA73D0&google_push=AXcoOmRPknifrRqIAKFTzT8YReF06rX_sVu2Tje8Y3E9ong2tUh_okO7kKL_P2rM-Xi0wK5hTtnEjXfiVKJnvUU...

170 B
188 B

49ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C33A1BCE82AC4F94BEBAC736CEBA73D0&google_push=AXcoOmRPknifrRqIAKFTzT8YReF06rX_sVu2Tje8Y3E9ong2tUh_okO7kKL_P2rM-Xi0wK5hTtnEjXfiVKJnvUUN7l6j6pV02Ry2IA

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C33A1BCE82AC4F94BEBAC736CEBA73D0&google_push=AXcoOmRPknifrRqIAKFTzT8YReF06rX_sVu2Tje8Y3E9ong2tUh_okO7kKL_P2rM-Xi0wK5hTtnEjXfiVKJnvUUN7l6j6pV02Ry2IA
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 08 Dec 2023 20:30:22 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 446A 0
174 B 145ms
47ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESENIJ6wJvjStBY6pZ8JBwxh4&google_cver=1&google_push=AXcoOmRjq5BATondazxJ_kGT75g_N1RCal93fTomEL5beWpf-kF0gSKjfygfIjZzihjym_8GW6pHO4LHUPCO2bMhauZpSzzsy3J2yw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=544349898&adf=1397456241&pi=t.aa~a.2282482148~rp.4&w=333&fwrn=1&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=3&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2054&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 446A
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEFG5u4OHkWfVtgeT2PlYlLw&google_cver=1&google_push=AXcoOmRL8EIKE_w8ZjRN08_1MD5GpkakzIUEuSwCeZeA4Mu0507-ey6eqAcz0on_oETBJ17vgyfWC8zblCa3v4E1...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=t0FqChvBS-4IbNlO-dIUWA&google_push=AXcoOmRL8EIKE_w8ZjRN08_1MD5GpkakzIUEuSwCeZeA4Mu0507-ey6eqAcz0on_oETBJ17vgyfWC8zblCa3v4E1PCoeE9uOdo1LDvE

170 B
188 B

51ms
51ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=t0FqChvBS-4IbNlO-dIUWA&google_push=AXcoOmRL8EIKE_w8ZjRN08_1MD5GpkakzIUEuSwCeZeA4Mu0507-ey6eqAcz0on_oETBJ17vgyfWC8zblCa3v4E1PCoeE9uOdo1LDvE

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=t0FqChvBS-4IbNlO-dIUWA&google_push=AXcoOmRL8EIKE_w8ZjRN08_1MD5GpkakzIUEuSwCeZeA4Mu0507-ey6eqAcz0on_oETBJ17vgyfWC8zblCa3v4E1PCoeE9uOdo1LDvE
x-host: tde-deliveryengine-production-5989b845bf-csmkb
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame 446A 43 B
145 B 42ms
40ms Image
image/gif 35.156.190.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEKTL2OUR3WCSST24w1dzIXM&google_cver=1&google_push=AXcoOmRjHu8q81Ah1O9jGXETplXmmUs_33CT612AIsKdQUHmtp1aYVO6EnNQxlZR5VdPzUabmLiwFDrG4fIaxA1yYqv51F0qMj77Fgw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=544349898&adf=1397456241&pi=t.aa~a.2282482148~rp.4&w=333&fwrn=1&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=3&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=2054&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.156.190.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-190-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 446A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEK7Rmk-2qvovFhjKeNVRYBg&google_cver=1&google_push=AXcoOmR7d7YfoKbXXcc2-UFWD3bzh-UsIjzAt4SUpOBT1hBZg-5WbF17id0PMRFEwffXg257iW5Pl_hPXKx6tkUNrQYrlmI...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR7d7YfoKbXXcc2-UFWD3bzh-UsIjzAt4SUpOBT1hBZg-5WbF17id0PMRFEwffXg257iW5Pl_hPXKx6tkUNrQYrlmI-lKU7sg&google_hm=eS1HMU42ZFkxRTJwRlFp...

170 B
188 B

50ms
50ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR7d7YfoKbXXcc2-UFWD3bzh-UsIjzAt4SUpOBT1hBZg-5WbF17id0PMRFEwffXg257iW5Pl_hPXKx6tkUNrQYrlmI-lKU7sg&google_hm=eS1HMU42ZFkxRTJwRlFpbmZfTXJnOXAuemwxbjZocjNfWX5B

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmR7d7YfoKbXXcc2-UFWD3bzh-UsIjzAt4SUpOBT1hBZg-5WbF17id0PMRFEwffXg257iW5Pl_hPXKx6tkUNrQYrlmI-lKU7sg&google_hm=eS1HMU42ZFkxRTJwRlFpbmZfTXJnOXAuemwxbjZocjNfWX5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 446A 43 B
362 B 39ms
39ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQWUnx-v4WGdwrjESfvh_hc-jeV6bELqixdQBxL7kp3i0iCJsV5Du_XdWW08GowgpTgKUORVx16JF58xfPojHCz6ysysfAeIg&google_gid=CAESEL0g0b-mH-c2aep7vlTetuo&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 152487
expires: Sat, 09 Dec 2023 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 446A 0
12 B 47ms
46ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IgXCDmNEgBCWfT7Gw617iwluOfAur1x8x-5KdxYSAinn0Kl8Wg3ZkLVWt2p_Zf30ZOh0ZL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/ Frame 8DE3 13 KB
3 KB 76ms
76ms Document
text/html 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae3a0957fc5669d282e41e4d6107d528898f07b480ec550cb34ba6797a384b8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3256
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 20:30:22 GMT
expires: Sun, 08 Dec 2024 20:30:22 GMT
last-modified: Fri, 23 Dec 2022 09:31:26 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 9F17 0
0 86ms
86ms Fetch
image/gif 172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuPxC6xxZucfwwy6XLwz1ZMfnj0RPRGomMknFHLfSnEmro8Wx_2ffEyTzSTB-9bRQ57XtwdPOPZZe-PJLMM0rtxZOy7nRupg8c3qvmCv02VUN5u-OcqTYzAq2j18wbjzPE-EV4_QrrKmFtyTSXaJWn4bvr5CXEYmewvDdxa1NJ7lSdELTUIucMSWJEjIbtMtGP5AuUWTPJWrdzWBoJ7gXekJvEttvyMQUEOkFEZRLxiHImOYNVgrQjNqojmtVawvsFN2ihdY76q4BhXwH5Op-McT4BfeDNk4LOUCeDesgg8WkuR-1US-uoXLmosoUzXfC2u9ZSbU6LOZSoGNDsw5I5gv06EMMxk4fT8NFTopDWcdYmo2psnSga1zURa42ez7TWC88V9z1R6-7cjkUNLHF0WKARAX5-L1jRcio8UQFNffc1kWVClRTcVrVHYZWHGBMvs7hzmDfY2aSIhnh7eYOxzHT8Xht_N4GkinAyn51o_M7uXmxKids-uxXwjl7kZs56A3h_dnc9KfOfcZVR-jNjkw_za14PZX-86x4mwEDy-HDIQPz85TZSsHUmRXVyHsWUEBg6n7mq2cw9H7B1w0v6X-Zkuonl_zPMCcC7jNldvXVsi8jzaSQgemLKUwGzJgPH-6g0CfEM81Xqd8dRDy4GgrkFJ57Ph3BRF6CQoMoUzbnhz3YvX8FfOrVuPagejxhEth_auSoxsW7Gf9AaJec2p-boJZ78LbBsrMI_DMwUkQpmNcfAlfrmomK13JgaSwyBMsYu05FQw9iDLw9W2RCW-607bi0Gi6LsXb_j7QI8o2p-AbBb2nvztnbYUbAbuvz69EYaS-c8qInbpoF5n1-V9EwwntLkBEMjmmkmGSbSVj2DQQ1_VmMXQgyOTN_otYir9pDywtND2TW1KQkEbjcQxz8b4c9RorLIE0haYgUyBYgKU8ITvZKoOn1AfAvabOejjKfe1donNwhsk0IL5UWqJK-zVl0D5L2Fj3EybZSrq9TkPU-MSLPVOUEi66EQXmqtIogctsubFmLC7l3zMQUI9R1JB52sP0lqNJwUbUos5GKHU9_FxE5HqVkdUULxbcmDJKAg9oBuhxegAFcrAH4JCfZrmHVMGQGWMtOn4npCZGHICPRFa52MgNO9V9PimGSzchSFCGj-aXqXKxH2XxQBhTjpbbPnyA-_t-2L9o4AzLsdPuE2ZiqyrUyp0_eaxUrC3b4vaC47a9XDPjDlLsjr-fBWTJxmw8ABjqbzpU2DFBQYWw5Td4vVzEbc8Uvc4hyzq71KQCnT4lS_aHBJJ3o57Po1HYdrmMsNfwu60OCEQil33bYxz0qw0-cSiYmMVuqWZ4Un_ibqJtr841_I3qsm8CEA&sai=AMfl-YS5g7AMi1Ml604QOhmPXcnPGSl54HUmEIAFljZV2HhTBLMdOrfF98Wuik_T9KGee4qXi3lszuBmcohsryoGJ076PVpHmuAhO6T-gn63KkBUCA8D8XaPj3i3KIqdPFoA5qifIysz-1B1GXTm3uotukCAwUkhbcujTJWPFNkukYzN-d6VDP25GHU5jlabnGY9d_1-AtwZroAGKmKRTC9GtRN3IDKebdMGv1QgwqhoYq5Np8lA6lnJtcSEfTqeZDU-OtalYV-vZ0FK3_IuRJJNGilmG54GX7UkwCXzMJ3b2tvkJjAnuh9siYG-pS3wKvkkDWMjgi3vrk5DY9Zvrg7a7cEu9SyOoyKq81OdW76_yBtF-vdmrdQsEj9iSbK1abkO3P4qQWnF6QTYkweFNzKcc-CdaXWUfAa_kcBbJYgwBLpCZzelTrw&sig=Cg0ArKJSzChrJz63kam1EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jYW52YS5jb20saHR0cHM6Ly9hZC1saWIuaW8&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=301&cbvp=1&cstd=297&cisv=r20231206.23177&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 76ms
75ms Preflight
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 20:30:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 9628 39 KB
15 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 14:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23330
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 14:01:32 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame B65D 39 KB
15 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 14:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23330
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 14:01:32 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 4AB9 16 KB
16 KB 44ms
44ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 23:58:11 GMT
x-content-type-options: nosniff
age: 73931
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 23:58:11 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 4AB9 15 KB
15 KB 41ms
41ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 21:25:42 GMT
x-content-type-options: nosniff
age: 83080
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 07 Dec 2024 21:25:42 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame B0B3 38 KB
13 KB 39ms
39ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 60274
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 03:45:48 GMT
expires: Sun, 08 Dec 2024 03:45:48 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal900015.redintelligence.net/ Frame BB16
Redirect Chain

https://hal900015.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900015.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

220ms
142ms

Script
application/x-javascript

138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC49SBXc50ZcThGKaC1fAP-emvEKblvaBprZWcp8kP8C4QASCM6pZ-YJWCgICYB8gBCakCYi2If_cOsj6oAwHIA5sEqgT0AU_Qtonc6MgcjJe1DiqUUgR9s7XxVvT21QF0Dj0vetL1j-E4vmcME2_rXv9v91HmIwfIWfPzzfY-BrVm43NMKJl-igGpLeVI53NgnXd3s9vTp7vCrUmoKwVUPtoMpD-YVMFniSnuotoiksIWyDXg6fd_QdYDBFGEwNQm1N5f2jj1QKV3LZd4LaqJNL0D85YOybHsEfvthn7g-vnKnGo3RmglgX812yVrmenKW4M1oSgcendI-nKlE9KrIDktZXsB5xhY07UU7NSNwL2NbgNjPlmeC2z2NBo-a4zSBn3Gr1fQ-VvRylcKsNrUuXFCASkksZ74bHLABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYtOKCj5mDgwOACgGYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB%26sig%3DAOD64_2vFgcAiqvR5lryku98cOn5AMfedg%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-BiXpH6QfzlnUzjj6GaDXauxP0YT_mooCiw6hw9MUAjLt-l8OZWWBRQht9WQAOFnpjpfEwlriEH8LYevd2Wd6qTnbac8wVsQ-7Rb_GHrn_9BcC2m3uOvAqyshSpH1HHoygGq9yHeb9sRYHeak6lk-8SKQxv7zf3QUmA8fEXS7qUYmcOSBI%26cry%3D1%26dbm_d%3DAKAmf-DmqDrg0Yosop6hItrqFwoLRi6L8te0NWMKEUiPHwpYBwpOUSgu_mOHpFjjKebrok08D-oDDSLWL75XqkxMSJu0pM-g26hUQU2S4j2CKDcJ1WSgdgm-0XHykbTE375driNSAKYQfpK07HaKJPCV_HLo_CMT5xFImDqZ3mTqMPII3Vq-2GJhYPNkUpOYTlHza_TKtyAga1Acffl0ZsoFpfsbfyD5a1q2EvmYDMMTFi_cetRwJ8OP0PIFT8CFmiKJ-xoPkUiPV60-8GAW_7E28Ipyd--tAECKem2F4KOUaRM6Ko6eSo5RTlJyAc5PyfzRpCnGoEcsVqcamZrX-E7SE9rgNvfYYR9g5jS-j47nt3x-CnYuWFkhTKUDkdr_nM5VegVSSHUZ_RMLXzO56i82--6XzZDeZCGlBR073Wo5XZDPDdY5T-fUNd6vq_28n67G22DJeWBI4LMEig3xVcuOAtihMN2phFbIEtcpamJTFallCTrSzWLHXV76k10mpj0yhMoRuhYvCU9ni9RU9Z6A2HW-dOo2zA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D250%26adk%3D1386011911%26adf%3D3310370695%26pi%3Dt.aa~a.3704686030~rp.1%26w%3D333%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1702153821%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D333x250%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1702153821343%26bpp%3D1%26bdt%3D2418%26idt%3D-M%26shv%3Dr20231206%26mjsv%3Dm202312050101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C333x250%252C333x250%252C333x250%26nras%3D7%26correlator%3D976130164160%26frm%3D20%26pv%3D1%26ga_vid%3D1605096954.1702153820%26ga_sid%3D1702153820%26ga_hid%3D1713484531%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1037%26ady%3D3626%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C95320238%252C31079920%252C44807751%252C95320884%252C21065725%26oid%3D2%26pvsid%3D3915279353731801%26tmod%3D1996945669%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D7%26uci%3Da!7%26btvi%3D5%26fsb%3D1%26dtd%3D23&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3783825617135&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
Protocol: HTTP/1.1
Server: 138.201.135.164 St. Ingbert, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 306c386e5fd513b6f2b31b7c828b9059bc33e2ef1924911d76d8e8b98df0f941

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 20:30:22 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 52738500116718204444554012533015
Connection: close
Content-Length: 1323
Expires: Sat, 09 Dec 2023 20:30:22 +0100

Redirect headers

Pragma: no-cache
Date: Sat, 09 Dec 2023 20:30:22 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC49SBXc50ZcThGKaC1fAP-emvEKblvaBprZWcp8kP8C4QASCM6pZ-YJWCgICYB8gBCakCYi2If_cOsj6oAwHIA5sEqgT0AU_Qtonc6MgcjJe1DiqUUgR9s7XxVvT21QF0Dj0vetL1j-E4vmcME2_rXv9v91HmIwfIWfPzzfY-BrVm43NMKJl-igGpLeVI53NgnXd3s9vTp7vCrUmoKwVUPtoMpD-YVMFniSnuotoiksIWyDXg6fd_QdYDBFGEwNQm1N5f2jj1QKV3LZd4LaqJNL0D85YOybHsEfvthn7g-vnKnGo3RmglgX812yVrmenKW4M1oSgcendI-nKlE9KrIDktZXsB5xhY07UU7NSNwL2NbgNjPlmeC2z2NBo-a4zSBn3Gr1fQ-VvRylcKsNrUuXFCASkksZ74bHLABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYtOKCj5mDgwOACgGYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB%26sig%3DAOD64_2vFgcAiqvR5lryku98cOn5AMfedg%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-BiXpH6QfzlnUzjj6GaDXauxP0YT_mooCiw6hw9MUAjLt-l8OZWWBRQht9WQAOFnpjpfEwlriEH8LYevd2Wd6qTnbac8wVsQ-7Rb_GHrn_9BcC2m3uOvAqyshSpH1HHoygGq9yHeb9sRYHeak6lk-8SKQxv7zf3QUmA8fEXS7qUYmcOSBI%26cry%3D1%26dbm_d%3DAKAmf-DmqDrg0Yosop6hItrqFwoLRi6L8te0NWMKEUiPHwpYBwpOUSgu_mOHpFjjKebrok08D-oDDSLWL75XqkxMSJu0pM-g26hUQU2S4j2CKDcJ1WSgdgm-0XHykbTE375driNSAKYQfpK07HaKJPCV_HLo_CMT5xFImDqZ3mTqMPII3Vq-2GJhYPNkUpOYTlHza_TKtyAga1Acffl0ZsoFpfsbfyD5a1q2EvmYDMMTFi_cetRwJ8OP0PIFT8CFmiKJ-xoPkUiPV60-8GAW_7E28Ipyd--tAECKem2F4KOUaRM6Ko6eSo5RTlJyAc5PyfzRpCnGoEcsVqcamZrX-E7SE9rgNvfYYR9g5jS-j47nt3x-CnYuWFkhTKUDkdr_nM5VegVSSHUZ_RMLXzO56i82--6XzZDeZCGlBR073Wo5XZDPDdY5T-fUNd6vq_28n67G22DJeWBI4LMEig3xVcuOAtihMN2phFbIEtcpamJTFallCTrSzWLHXV76k10mpj0yhMoRuhYvCU9ni9RU9Z6A2HW-dOo2zA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D250%26adk%3D1386011911%26adf%3D3310370695%26pi%3Dt.aa~a.3704686030~rp.1%26w%3D333%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1702153821%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D333x250%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1702153821343%26bpp%3D1%26bdt%3D2418%26idt%3D-M%26shv%3Dr20231206%26mjsv%3Dm202312050101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C333x250%252C333x250%252C333x250%26nras%3D7%26correlator%3D976130164160%26frm%3D20%26pv%3D1%26ga_vid%3D1605096954.1702153820%26ga_sid%3D1702153820%26ga_hid%3D1713484531%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1037%26ady%3D3626%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C95320238%252C31079920%252C44807751%252C95320884%252C21065725%26oid%3D2%26pvsid%3D3915279353731801%26tmod%3D1996945669%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D7%26uci%3Da!7%26btvi%3D5%26fsb%3D1%26dtd%3D23&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3783825617135&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Sat, 09 Dec 2023 20:30:22 +0100

GET
H3 200 adlib.css
s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/ Frame 8DE3 6 KB
2 KB 43ms
42ms Stylesheet
text/css 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/adlib.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c821ac5b54d6356aa81644902d5fad10603c9a415679c081d7760dde7f7bdbd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 22:01:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 80952
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1924
x-xss-protection: 0
last-modified: Fri, 23 Dec 2022 09:31:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 22:01:10 GMT

GET
H3 200 adStyle.css
s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/ Frame 8DE3 3 KB
767 B 41ms
40ms Stylesheet
text/css 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/adStyle.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be5de26b4c662c492dc47273afe90d3c778ec25998dd2a3a6f7f291c26ca5803

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 19:27:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90179
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
last-modified: Fri, 23 Dec 2022 09:31:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 19:27:23 GMT

GET
H3 200 CanvaSansDisplayBold.woff
s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/ Frame 8DE3 37 KB
37 KB 57ms
57ms Font
font/woff 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/CanvaSansDisplayBold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79630aa66a2fd742af143103e8114c9ea35d4308fd3523bd101a89d8b908923a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 21:04:46 GMT
x-content-type-options: nosniff
age: 257136
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37712
x-xss-protection: 0
last-modified: Fri, 23 Dec 2022 09:31:26 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 05 Dec 2024 21:04:46 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 8DE3 118 KB
40 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 21:54:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81334
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 21:54:48 GMT

GET
H3 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 8DE3 57 KB
23 KB 105ms
104ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 09 Dec 2023 20:30:22 GMT

GET
H3 200 textFit.js Show response
s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/ Frame 8DE3 8 KB
3 KB 44ms
43ms Script
application/x-javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/textFit.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8e48ea465007a8f3473fecfbcfe2e31e0d807e98f8ab65f8b0e655779ae2b72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 21:17:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83564
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2875
x-xss-protection: 0
last-modified: Fri, 23 Dec 2022 09:31:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 07 Dec 2024 21:17:38 GMT

GET
H3 200 adlibUtils-v3.js Show response
s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/ Frame 8DE3 25 KB
11 KB 46ms
46ms Script
application/x-javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/adlibUtils-v3.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aefdb07258782fc3aa84dc518ab2052e5b1dad3405867fb1f9d65f816b03c12a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 01:32:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68295
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10802
x-xss-protection: 0
last-modified: Fri, 23 Dec 2022 09:31:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 08 Dec 2024 01:32:07 GMT

GET
H3 200 animation.js Show response
s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/ Frame 8DE3 3 KB
1 KB 88ms
88ms Script
application/x-javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/animation.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d473d1cb26421c33200e6a1e036a17e738f4ca3dce4f404b708e9f8ab4f75c82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 10:57:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34363
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1014
x-xss-protection: 0
last-modified: Fri, 23 Dec 2022 09:31:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 08 Dec 2024 10:57:39 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 4AB9
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CLkbkXc50ZcTSF9SJ1fAPi8iOsATlkKj7c7TKj9bQEbCygOyQAhABIIzqln5glYKAgJgHoAGkn5DXA8gBCakCYi2If_cOsj6oAwHIA8sEqgTgAU_Qvm-YltyccAuXu-zYVLJMUXX_Yt428j2...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2211560245801037460965%22,%22debug_reporting%22:true,%22destination%22:%22https://vichy.de%22,%22event_report_window%22:%222...

0
0

74ms
74ms

Fetch
text/css

142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2211560245801037460965%22,%22debug_reporting%22:true,%22destination%22:%22https://vichy.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22988024740%22],%224%22:[%2212-09%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2210450250105924537857%22}&andc=true

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"11560245801037460965","debug_reporting":true,"destination":"https://vichy.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["988024740"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"10450250105924537857"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Sat, 09 Dec 2023 20:30:22 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"11560245801037460965","debug_reporting":true,"destination":"https://vichy.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["988024740"],"4":["12-09"],"6":["true"]},"priority":"500","source_event_id":"10450250105924537857"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js Show response
pagead2.googlesyndication.com/bg/ Frame B239 51 KB
19 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1_7gewjyGlqcOFIguOJ5AHUn6L-zJDTVPaBHJ2ADYro.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7fee07b08f21a5a9c385220b8e279007527e8bfb32434d53da04727600362ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 04:53:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19719
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 04:53:58 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame B0B3 39 KB
15 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 14:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23330
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 14:01:32 GMT

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 75ms
75ms Preflight
text/html 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Sat, 09 Dec 2023 20:30:22 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B65D 0
20 B 79ms
79ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BEZZ4Xc50ZYLLGIDJ1fAPmba48AsAAAAAOAHgBAI&bg=!cXKlcj3NAAY3kmNgF5I7ADQBe5WfOG4kDWorItE5JNlhUvsOhMjAKIMmUOvQA87BhBXXUqm5zJ3Obttrw0u_MOXEBLOxAgAAAFRSAAAAAmgBB5kDQgHH1wsgC-tGZtIZOumksMvLwn1Fb0fNyn1CbPLtXA0k0ZLiO0hC3osD-qaHa3lz4e3f3eoESxukdrBDwLOQj8pzhBmLuyJVWqIija_Koc1ctOLnQ-gzFXz3RT37ydBkBcLVfTkOGAy_1BdCNl-muq8KpsRIxKjhTFviyiM0GIUm14-ybm-ywrYt-xEi5H_BO1fEGVWevVEPR4l7dn0Qk46kyT_EN_Yxz2pMwmmBHXexl8_A6akThzWehv7uMsr_5phkhXT_9GmG_nm7y23IewudFewWyFJlbxlB56bLS2oUeS9V45f0vYUdcCqfcnTQJsZGLK4qA6nSuwZ72CUMbAuzODjhiQb8V9CTKHdJRN2RJUYKusPr2gxDSol979iEpWaKoabqnvsHDdcxdUYKoPmsXAatQ-xy3bpH6rg3wisUmIVro4LuM5qXiRhkEP9D5i_xEdvq_Utrn_EBgCtu3yum4K9gXwnoMpk7Bgooyomq3iEU0PxzBTuIR42k05Zyq8RIdsziLGJY4Jjfy_d8Mz0cSDQm4bOn61udpp9fx07YuuYtXr0Qx7BCozSasST7od2lMQhBt2Vvp7N6neh5Ymdza3P0nH1oq-K4dXS3PodR-mHIFVXO3qKo_-U8FOAdHdX8yYilbefNyze1D-Q8pC24G_PiNiT9o4v7hUIHcyjbUtIYnVmF7-m6kYpct_tlKtnKvbiGlEfuBbLBbqWQYBg2FDQ01n0EK2Ff35IrO7pESwyUy-p217f9j2a102onlf8B872tJxcqe8zItB5Cvq8b0b6sR4ZlaI2CFulYwHTbbeSzW6cAfNgBX_dFOrMzWTWEqzULK1bcSFbAe3N0fQdZR5yliDXaNZxGJzS29t8YGfZH8PmafGoRNYTCfh5QEx-Yry2NQxdx3OGmMjviFqWAGfrxb0p2fscx0XnqJKsfZY0Y269KMhonsphd4C3XmI4psfzSDQlI-j7eG92BFChutoJKH2nT-2EidwuI5KRI5cFexOdvoQUhVMyAXYTmwpLBMKte-zAcMKniqxIqJjw_9uCJvomIHCf7cVXBO6Wnr2QRpFsGuqaCSNJdRQ0GKHtGXkkKdWJNuGM9OzyXeeVNHA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=2157672967&adf=456927041&pi=t.aa~a.2384378475~rp.4&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2419&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250&nras=6&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3096&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9628 0
20 B 81ms
80ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bf3s3Xc50ZaicGNTA1fAPio-2oAsAAAAAOAHgBAI&bg=!CQqlCkXNAAY3kmNgF5I7ADQBe5WfONvUKNBvIMlw7ZlSx3pPoL_TqfyGHz4fZdsNovHv4r1OdfyrHgOlZFThgo_l09PNAgAAAGpSAAAAAmgBB5kDQwezKJVw76awb_LrFPyKsghbKX5QmMSd6Yi6n8V7-yoRF2OJPZnTpLr5HWXzaIvzc3av6CqPrvN5X1s_sszP4plwBVvShNpWYduadtf9ZIAtCfJj92X6SVQ6EEYVLFOooEj5d-Yyr0OKwpvWykSWm67sUQ9YrPMG5uXDvxrKalL1gIdaDglqUobAKP-jpBwJbwrlukEnG_SOtwx4GgR_pjd8IhBgSpwBfs3fiy5YZvb5u8QixSE1-qNaHyt59aSVVik887zFgMMg1LX1AYAO50NupkJm5Q3Cg8SbyvmLcE6Od1_c_VBvntOv7wwi6H52RR5zmzZIaOy41JWPQANY5qZ_5gMhU_ND4BK2ynwLUijdSFE1mkQTyhiLOYT9cEeVkT-BBD7Co3740ik4V2tp9awXfN6BoQqSCwB4xdmgRgjyI_DvM7TkggztAAs62EF_kHs3ut0ayqsoOcDJOlnFnlSNpqdaQzcie7QdxFEJsHFWEYRks-Lb0Usilb6KlQZalKVwzHO6md7rkeHS4achHsGzDKs8Fvw-BL3UK5tG8KJWvkAB5OU_yP407KYH8SRt1BmZRBht5_5zxfZ1VclLuEn89SnuRpCXB6HS4U4lL1BFiwMiQ1cTp8yC-9eN0363Ub0VsaPu-GPiCjJeX5uzgKxS49X8WHvMQWRrhXGQgyHWGE2pqus4MkjpBByt2riTFVsmPSkACTuu8Of12V4Ie_tTInXctVIKfWardNRqYWV_qGN45HVRflZkpYLdNT09AiHOnvvGwMTXspFVP9oDPJXC0iBGuB7aH6D9OnSqNg8M3cjkoCuGmvq2cNroAKNtlQA7APhHxushr3K_96gerLno-9Pcj2usfeRemT9oYSKGC9-Ql63UUqkoZXZjRMCMcmG0sYiDla4ALGmM7HpFbv6DSRI1BQYbfmWK42c7EXCmmw1MP2p2-HUDwRJNN9uAld5ij-lNvbUglwXsKXiuOapf4LBES0R8E6g32AqyJVsjKrl_FVI3Fe9B6EjvdgxLhGDRMd1EOHHj5Yd5KRANPomEjLLI8jFuN8lyrq2M82ysWuge7xl5kWf2JK9ieVeIuxeV42oOzP02mgPIOyQlAfwYd6g

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 9F17 0
0 78ms
78ms Fetch
image/gif 172.217.18.6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuPxC6xxZucfwwy6XLwz1ZMfnj0RPRGomMknFHLfSnEmro8Wx_2ffEyTzSTB-9bRQ57XtwdPOPZZe-PJLMM0rtxZOy7nRupg8c3qvmCv02VUN5u-OcqTYzAq2j18wbjzPE-EV4_QrrKmFtyTSXaJWn4bvr5CXEYmewvDdxa1NJ7lSdELTUIucMSWJEjIbtMtGP5AuUWTPJWrdzWBoJ7gXekJvEttvyMQUEOkFEZRLxiHImOYNVgrQjNqojmtVawvsFN2ihdY76q4BhXwH5Op-McT4BfeDNk4LOUCeDesgg8WkuR-1US-uoXLmosoUzXfC2u9ZSbU6LOZSoGNDsw5I5gv06EMMxk4fT8NFTopDWcdYmo2psnSga1zURa42ez7TWC88V9z1R6-7cjkUNLHF0WKARAX5-L1jRcio8UQFNffc1kWVClRTcVrVHYZWHGBMvs7hzmDfY2aSIhnh7eYOxzHT8Xht_N4GkinAyn51o_M7uXmxKids-uxXwjl7kZs56A3h_dnc9KfOfcZVR-jNjkw_za14PZX-86x4mwEDy-HDIQPz85TZSsHUmRXVyHsWUEBg6n7mq2cw9H7B1w0v6X-Zkuonl_zPMCcC7jNldvXVsi8jzaSQgemLKUwGzJgPH-6g0CfEM81Xqd8dRDy4GgrkFJ57Ph3BRF6CQoMoUzbnhz3YvX8FfOrVuPagejxhEth_auSoxsW7Gf9AaJec2p-boJZ78LbBsrMI_DMwUkQpmNcfAlfrmomK13JgaSwyBMsYu05FQw9iDLw9W2RCW-607bi0Gi6LsXb_j7QI8o2p-AbBb2nvztnbYUbAbuvz69EYaS-c8qInbpoF5n1-V9EwwntLkBEMjmmkmGSbSVj2DQQ1_VmMXQgyOTN_otYir9pDywtND2TW1KQkEbjcQxz8b4c9RorLIE0haYgUyBYgKU8ITvZKoOn1AfAvabOejjKfe1donNwhsk0IL5UWqJK-zVl0D5L2Fj3EybZSrq9TkPU-MSLPVOUEi66EQXmqtIogctsubFmLC7l3zMQUI9R1JB52sP0lqNJwUbUos5GKHU9_FxE5HqVkdUULxbcmDJKAg9oBuhxegAFcrAH4JCfZrmHVMGQGWMtOn4npCZGHICPRFa52MgNO9V9PimGSzchSFCGj-aXqXKxH2XxQBhTjpbbPnyA-_t-2L9o4AzLsdPuE2ZiqyrUyp0_eaxUrC3b4vaC47a9XDPjDlLsjr-fBWTJxmw8ABjqbzpU2DFBQYWw5Td4vVzEbc8Uvc4hyzq71KQCnT4lS_aHBJJ3o57Po1HYdrmMsNfwu60OCEQil33bYxz0qw0-cSiYmMVuqWZ4Un_ibqJtr841_I3qsm8CEA&sai=AMfl-YS5g7AMi1Ml604QOhmPXcnPGSl54HUmEIAFljZV2HhTBLMdOrfF98Wuik_T9KGee4qXi3lszuBmcohsryoGJ076PVpHmuAhO6T-gn63KkBUCA8D8XaPj3i3KIqdPFoA5qifIysz-1B1GXTm3uotukCAwUkhbcujTJWPFNkukYzN-d6VDP25GHU5jlabnGY9d_1-AtwZroAGKmKRTC9GtRN3IDKebdMGv1QgwqhoYq5Np8lA6lnJtcSEfTqeZDU-OtalYV-vZ0FK3_IuRJJNGilmG54GX7UkwCXzMJ3b2tvkJjAnuh9siYG-pS3wKvkkDWMjgi3vrk5DY9Zvrg7a7cEu9SyOoyKq81OdW76_yBtF-vdmrdQsEj9iSbK1abkO3P4qQWnF6QTYkweFNzKcc-CdaXWUfAa_kcBbJYgwBLpCZzelTrw&sig=Cg0ArKJSzChrJz63kam1EAE&uach_m=%5BUACH%5D&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9jYW52YS5jb20saHR0cHM6Ly9hZC1saWIuaW8&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=549&vt=11&dtpt=248&dett=3&cstd=297&cisv=r20231206.23177&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.6 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 8DE3 8 KB
6 KB 164ms
84ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ff0ac85ecb3b02b29ea14e440f9f599ac60cac6cb617fdf6c192391f933633b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5940
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B0B3 0
20 B 76ms
75ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BE5y1Xs50Zb72BKiWjuwPkPCFsAUAAAAAOAHgBAI&bg=!XF-lXxDNAAY3kmNgF5I7ADQBe5WfOPdKPMz1I6zMJtyIL1VF-H21FRSzFyT_NyLfd4UB2d6ePfN7hKfLXCNyC_x9xDlgAgAAAERSAAAAAWgBB5kDTZdCzckmcyJrxevNcIBrLRRVauAATU3EwsZzx9qL8BkmRbru1Qu4GxLEo94eBRaY2uucxAqJc46RzdqLFT4-cGEKpops7N5lH5kH1YatxjVYaECrIDy9l9qqXjOf-Uw2DZTubtj_XSYgV9Gbz9trv8tZhk82jd4kiunzsLLsBkxyMPSErp5J_6WuDV9I5tPJo_w3vJsoWbetbulRL11PEvZvrQhJuO1JYXJFQMR62jzdQmVKbOysELcoUikRkOm4CdaMHgCAePcZ7ItPq7zORtwBg4V3UTGKo_jYgy_s2PZW7OnX3eX3_x_gPz7IPILCuUMzk-TfuXO7kanHZ4ISHpNc0ko1T_QeTxLJPxvaWwLSDORWT7DEODMBd8hZB2DyMQsFM1hkFrm5MW4lKGdNyYEFLIDYLRGBFp3tpwgUD1BGhziNMmFXxdM3dls4dQZu7HLl5P2CiYmoRlZaSzFTMHAgAaf2Moc_L-eIEZ8XJ35vlUIRUtOXFUGqa6vMPn3REaikHb7-rPxbT5rE0Uuo0aLTYmF7yLl4UjHkF9RkKCksUknzZQWodjQMMI-I6_t4PGlCwEeZP7vkE1iqqEp9734F2JxhcgZFRtcLrPy6q64FyYAisSHRMwPjeKgG82P8AEiXm5VCykaqA5kH7szV3Tjdc5zdiRuUtjTuwKM9UdphxXiPgrkdDjTo9EuDdBXufl5TK07cKktE7R5VNkfBQ4-yXaTGeexhWkBOlvkV1TRMKULHnHkqqU-TtuunaC2EcBm4eQFxzOyDKGa1AvA37ORZQUFKIsS522ZgI4plfiYozi1h-RtVbREc4YParY6dxgSFSY70UcHn9T4ktUE274AjISPlPNpm0DcE8RdOwuEbUZ-vkfGP8tuoGLoFnfh5jtbLKzbvyyTIIaeEc8tW_gIR40doxMwkoeOLdNfjz4gpvXsdEkOWmko_eWo5FGeI2I16bY-kXaiL-BnSL8y0YbZSrcwYHC8vQoXL0qV-Qm5qb0w5A9Q8anrtJfNVcaW7DeUNivsu7A51th1I9nmMHKQMa8VrcdhcJDYR2StBTkz0WeNpa1KFJ0oUA25Hg4jNv9FHU9sOVJAC5EMj0zOwfNuY56IecQofKJFldwtj

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 frame1Background.png_1671714812913_frame1Background.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/ Frame 8DE3 195 KB
195 KB 44ms
43ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/frame1Background.png_1671714812913_frame1Background.png

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f088c64037818e781f6357d237de7dfb8b1800b2d27a222b79e08aff9b6c96ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 21:52:57 GMT
x-content-type-options: nosniff
age: 81445
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199187
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 21:52:57 GMT

GET
H3 200 blank.png_1671714812913_blank.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v3/partners/633cdb43c2dff55335fd416b/assets/singleFiles/63a3f0cb03497090adda2da6/original/ Frame 8DE3 191 B
220 B 61ms
60ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v3/partners/633cdb43c2dff55335fd416b/assets/singleFiles/63a3f0cb03497090adda2da6/original/blank.png_1671714812913_blank.png

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

80a466c320c6c23384298a00c8a1192195225a11d1bce68328cf37a6bce29aa9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 23:13:42 GMT
x-content-type-options: nosniff
age: 76600
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 191
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 23:13:42 GMT

GET
H3 200 logo2.png_1671714812913_logo2.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/ Frame 8DE3 3 KB
3 KB 60ms
59ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c3e404f048288e67b6048f88e121f4c5f3927377058000a01e057b1ff218839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 01:16:39 GMT
x-content-type-options: nosniff
age: 69223
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3138
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 01:16:39 GMT

GET
H3 200 logo3.png_1671714812913_logo3.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/ Frame 8DE3 3 KB
3 KB 59ms
58ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0bdc4694a5f3bdd17a15d5dfc5375fe32ca435f5d81cff6c3bda066e18ebb2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 13:08:34 GMT
x-content-type-options: nosniff
age: 112908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2974
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 13:08:34 GMT

GET
H3 200 spritesheet.png_1671714812913_spritesheet.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v3/partners/633cdb43c2dff55335fd416b/assets/singleFiles/63a3fc1b0349706994dac3a8/original/ Frame 8DE3 628 KB
629 KB 50ms
49ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v3/partners/633cdb43c2dff55335fd416b/assets/singleFiles/63a3fc1b0349706994dac3a8/original/spritesheet.png_1671714812913_spritesheet.png

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2decfcea631dc6e5a39e44aa0bf4be206b10870490d78d75996c896b5a6825df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 23:00:56 GMT
x-content-type-options: nosniff
age: 77366
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 643531
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 23:00:56 GMT

GET
H3 200 frame1Image2.png_1671714812913_frame1Image2.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/ Frame 8DE3 27 KB
27 KB 61ms
60ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3aa12d2d3f125294a2bb3ef90ef5cc4d99e2e26f2b05f1fd44eba25fe1674823

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Fri, 08 Dec 2023 13:08:34 GMT
x-content-type-options: nosniff
age: 112908
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28114
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 07 Dec 2024 13:08:34 GMT

GET
H3 200 blank.png_1671714812913_blank.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/ Frame 8DE3 927 B
955 B 58ms
57ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c45dbdb7b09412d6e8d0a108245bf284d53a80fe178119869ca65654c0621a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 07:33:21 GMT
x-content-type-options: nosniff
age: 46621
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 927
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 07:33:21 GMT

GET
H3 200 frame1Image4.png_1671714812913_frame1Image4.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/ Frame 8DE3 31 KB
31 KB 53ms
53ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b0254fd8f86e2ca0c495ad707da3cf3003df8bd6be01c70a5afbc68f8234b80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:43:38 GMT
x-content-type-options: nosniff
age: 38804
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31984
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 09:43:38 GMT

GET
H3 200 logo.png_1671714812913_logo.png
s0.2mdn.net/dynamic/2/11032346/cdn.ad-lib.io/v2/partners/633cdb43c2dff55335fd416b/assets/concepts/634e1187c2dff56bd63c1f5d/templates/63a1666b011c425078e946ce/content/ Frame 8DE3 12 KB
12 KB 63ms
63ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61eb4bd63b7ad05757982fcfd7badeeb3d592fa56e6999698e9f65b7ffeadf38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17822369404113911808/300x250-Canva-Evergreen/index.html?e=69&leftOffset=0&topOffset=0&c=Ws2WfVJb0c&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 13:04:51 GMT
x-content-type-options: nosniff
age: 26731
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12375
x-xss-protection: 0
last-modified: Thu, 22 Dec 2022 13:13:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 13:04:51 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 8DE3 17 KB
6 KB 50ms
50ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 09 Dec 2023 20:30:22 GMT

GET
H2

200

htlp Show response
futalis.de/ Frame B8CB
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=52738500116718204444554012533015&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3374028383

350 B
401 B

137ms
44ms

Document
text/html

167.233.14.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3374028383
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC49SBXc50ZcThGKaC1fAP-emvEKblvaBprZWcp8kP8C4QASCM6pZ-YJWCgICYB8gBCakCYi2If_cOsj6oAwHIA5sEqgT0AU_Qtonc6MgcjJe1DiqUUgR9s7XxVvT21QF0Dj0vetL1j-E4vmcME2_rXv9v91HmIwfIWfPzzfY-BrVm43NMKJl-igGpLeVI53NgnXd3s9vTp7vCrUmoKwVUPtoMpD-YVMFniSnuotoiksIWyDXg6fd_QdYDBFGEwNQm1N5f2jj1QKV3LZd4LaqJNL0D85YOybHsEfvthn7g-vnKnGo3RmglgX812yVrmenKW4M1oSgcendI-nKlE9KrIDktZXsB5xhY07UU7NSNwL2NbgNjPlmeC2z2NBo-a4zSBn3Gr1fQ-VvRylcKsNrUuXFCASkksZ74bHLABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYtOKCj5mDgwOACgGYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB%26sig%3DAOD64_2vFgcAiqvR5lryku98cOn5AMfedg%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-BiXpH6QfzlnUzjj6GaDXauxP0YT_mooCiw6hw9MUAjLt-l8OZWWBRQht9WQAOFnpjpfEwlriEH8LYevd2Wd6qTnbac8wVsQ-7Rb_GHrn_9BcC2m3uOvAqyshSpH1HHoygGq9yHeb9sRYHeak6lk-8SKQxv7zf3QUmA8fEXS7qUYmcOSBI%26cry%3D1%26dbm_d%3DAKAmf-DmqDrg0Yosop6hItrqFwoLRi6L8te0NWMKEUiPHwpYBwpOUSgu_mOHpFjjKebrok08D-oDDSLWL75XqkxMSJu0pM-g26hUQU2S4j2CKDcJ1WSgdgm-0XHykbTE375driNSAKYQfpK07HaKJPCV_HLo_CMT5xFImDqZ3mTqMPII3Vq-2GJhYPNkUpOYTlHza_TKtyAga1Acffl0ZsoFpfsbfyD5a1q2EvmYDMMTFi_cetRwJ8OP0PIFT8CFmiKJ-xoPkUiPV60-8GAW_7E28Ipyd--tAECKem2F4KOUaRM6Ko6eSo5RTlJyAc5PyfzRpCnGoEcsVqcamZrX-E7SE9rgNvfYYR9g5jS-j47nt3x-CnYuWFkhTKUDkdr_nM5VegVSSHUZ_RMLXzO56i82--6XzZDeZCGlBR073Wo5XZDPDdY5T-fUNd6vq_28n67G22DJeWBI4LMEig3xVcuOAtihMN2phFbIEtcpamJTFallCTrSzWLHXV76k10mpj0yhMoRuhYvCU9ni9RU9Z6A2HW-dOo2zA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D250%26adk%3D1386011911%26adf%3D3310370695%26pi%3Dt.aa~a.3704686030~rp.1%26w%3D333%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1702153821%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D333x250%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1702153821343%26bpp%3D1%26bdt%3D2418%26idt%3D-M%26shv%3Dr20231206%26mjsv%3Dm202312050101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C333x250%252C333x250%252C333x250%26nras%3D7%26correlator%3D976130164160%26frm%3D20%26pv%3D1%26ga_vid%3D1605096954.1702153820%26ga_sid%3D1702153820%26ga_hid%3D1713484531%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1037%26ady%3D3626%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C95320238%252C31079920%252C44807751%252C95320884%252C21065725%26oid%3D2%26pvsid%3D3915279353731801%26tmod%3D1996945669%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D7%26uci%3Da!7%26btvi%3D5%26fsb%3D1%26dtd%3D23&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3783825617135&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 167.233.14.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-2.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Sat, 09 Dec 2023 20:30:22 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3374028383
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2 200 e99aace94e6e5873881d3400993e1e7e Show response
pv.medialead.de/trck/epv/ Frame FBB9 0
327 B 172ms
49ms Document
application/javascript 91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=52738500116718204444554012533015&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC49SBXc50ZcThGKaC1fAP-emvEKblvaBprZWcp8kP8C4QASCM6pZ-YJWCgICYB8gBCakCYi2If_cOsj6oAwHIA5sEqgT0AU_Qtonc6MgcjJe1DiqUUgR9s7XxVvT21QF0Dj0vetL1j-E4vmcME2_rXv9v91HmIwfIWfPzzfY-BrVm43NMKJl-igGpLeVI53NgnXd3s9vTp7vCrUmoKwVUPtoMpD-YVMFniSnuotoiksIWyDXg6fd_QdYDBFGEwNQm1N5f2jj1QKV3LZd4LaqJNL0D85YOybHsEfvthn7g-vnKnGo3RmglgX812yVrmenKW4M1oSgcendI-nKlE9KrIDktZXsB5xhY07UU7NSNwL2NbgNjPlmeC2z2NBo-a4zSBn3Gr1fQ-VvRylcKsNrUuXFCASkksZ74bHLABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYtOKCj5mDgwOACgGYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB%26sig%3DAOD64_2vFgcAiqvR5lryku98cOn5AMfedg%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-BiXpH6QfzlnUzjj6GaDXauxP0YT_mooCiw6hw9MUAjLt-l8OZWWBRQht9WQAOFnpjpfEwlriEH8LYevd2Wd6qTnbac8wVsQ-7Rb_GHrn_9BcC2m3uOvAqyshSpH1HHoygGq9yHeb9sRYHeak6lk-8SKQxv7zf3QUmA8fEXS7qUYmcOSBI%26cry%3D1%26dbm_d%3DAKAmf-DmqDrg0Yosop6hItrqFwoLRi6L8te0NWMKEUiPHwpYBwpOUSgu_mOHpFjjKebrok08D-oDDSLWL75XqkxMSJu0pM-g26hUQU2S4j2CKDcJ1WSgdgm-0XHykbTE375driNSAKYQfpK07HaKJPCV_HLo_CMT5xFImDqZ3mTqMPII3Vq-2GJhYPNkUpOYTlHza_TKtyAga1Acffl0ZsoFpfsbfyD5a1q2EvmYDMMTFi_cetRwJ8OP0PIFT8CFmiKJ-xoPkUiPV60-8GAW_7E28Ipyd--tAECKem2F4KOUaRM6Ko6eSo5RTlJyAc5PyfzRpCnGoEcsVqcamZrX-E7SE9rgNvfYYR9g5jS-j47nt3x-CnYuWFkhTKUDkdr_nM5VegVSSHUZ_RMLXzO56i82--6XzZDeZCGlBR073Wo5XZDPDdY5T-fUNd6vq_28n67G22DJeWBI4LMEig3xVcuOAtihMN2phFbIEtcpamJTFallCTrSzWLHXV76k10mpj0yhMoRuhYvCU9ni9RU9Z6A2HW-dOo2zA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D250%26adk%3D1386011911%26adf%3D3310370695%26pi%3Dt.aa~a.3704686030~rp.1%26w%3D333%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1702153821%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D333x250%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1702153821343%26bpp%3D1%26bdt%3D2418%26idt%3D-M%26shv%3Dr20231206%26mjsv%3Dm202312050101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C333x250%252C333x250%252C333x250%26nras%3D7%26correlator%3D976130164160%26frm%3D20%26pv%3D1%26ga_vid%3D1605096954.1702153820%26ga_sid%3D1702153820%26ga_hid%3D1713484531%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1037%26ady%3D3626%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C95320238%252C31079920%252C44807751%252C95320884%252C21065725%26oid%3D2%26pvsid%3D3915279353731801%26tmod%3D1996945669%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D7%26uci%3Da!7%26btvi%3D5%26fsb%3D1%26dtd%3D23&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3783825617135&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript; charset=utf-8
date: Sat, 09 Dec 2023 20:30:22 GMT
host: pv.medialead.de
proxy-host: pv.medialead.de
server: nginx
vary: Origin

GET
H2 200 / Show response
adv.office-partner.de/ Frame CDF7 930 B
923 B 166ms
38ms Document
text/html 2a0b:4d07:101::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC49SBXc50ZcThGKaC1fAP-emvEKblvaBprZWcp8kP8C4QASCM6pZ-YJWCgICYB8gBCakCYi2If_cOsj6oAwHIA5sEqgT0AU_Qtonc6MgcjJe1DiqUUgR9s7XxVvT21QF0Dj0vetL1j-E4vmcME2_rXv9v91HmIwfIWfPzzfY-BrVm43NMKJl-igGpLeVI53NgnXd3s9vTp7vCrUmoKwVUPtoMpD-YVMFniSnuotoiksIWyDXg6fd_QdYDBFGEwNQm1N5f2jj1QKV3LZd4LaqJNL0D85YOybHsEfvthn7g-vnKnGo3RmglgX812yVrmenKW4M1oSgcendI-nKlE9KrIDktZXsB5xhY07UU7NSNwL2NbgNjPlmeC2z2NBo-a4zSBn3Gr1fQ-VvRylcKsNrUuXFCASkksZ74bHLABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYtOKCj5mDgwOACgGYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB%26sig%3DAOD64_2vFgcAiqvR5lryku98cOn5AMfedg%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-BiXpH6QfzlnUzjj6GaDXauxP0YT_mooCiw6hw9MUAjLt-l8OZWWBRQht9WQAOFnpjpfEwlriEH8LYevd2Wd6qTnbac8wVsQ-7Rb_GHrn_9BcC2m3uOvAqyshSpH1HHoygGq9yHeb9sRYHeak6lk-8SKQxv7zf3QUmA8fEXS7qUYmcOSBI%26cry%3D1%26dbm_d%3DAKAmf-DmqDrg0Yosop6hItrqFwoLRi6L8te0NWMKEUiPHwpYBwpOUSgu_mOHpFjjKebrok08D-oDDSLWL75XqkxMSJu0pM-g26hUQU2S4j2CKDcJ1WSgdgm-0XHykbTE375driNSAKYQfpK07HaKJPCV_HLo_CMT5xFImDqZ3mTqMPII3Vq-2GJhYPNkUpOYTlHza_TKtyAga1Acffl0ZsoFpfsbfyD5a1q2EvmYDMMTFi_cetRwJ8OP0PIFT8CFmiKJ-xoPkUiPV60-8GAW_7E28Ipyd--tAECKem2F4KOUaRM6Ko6eSo5RTlJyAc5PyfzRpCnGoEcsVqcamZrX-E7SE9rgNvfYYR9g5jS-j47nt3x-CnYuWFkhTKUDkdr_nM5VegVSSHUZ_RMLXzO56i82--6XzZDeZCGlBR073Wo5XZDPDdY5T-fUNd6vq_28n67G22DJeWBI4LMEig3xVcuOAtihMN2phFbIEtcpamJTFallCTrSzWLHXV76k10mpj0yhMoRuhYvCU9ni9RU9Z6A2HW-dOo2zA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D250%26adk%3D1386011911%26adf%3D3310370695%26pi%3Dt.aa~a.3704686030~rp.1%26w%3D333%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1702153821%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D333x250%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1702153821343%26bpp%3D1%26bdt%3D2418%26idt%3D-M%26shv%3Dr20231206%26mjsv%3Dm202312050101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C333x250%252C333x250%252C333x250%26nras%3D7%26correlator%3D976130164160%26frm%3D20%26pv%3D1%26ga_vid%3D1605096954.1702153820%26ga_sid%3D1702153820%26ga_hid%3D1713484531%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1037%26ady%3D3626%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C95320238%252C31079920%252C44807751%252C95320884%252C21065725%26oid%3D2%26pvsid%3D3915279353731801%26tmod%3D1996945669%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D7%26uci%3Da!7%26btvi%3D5%26fsb%3D1%26dtd%3D23&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3783825617135&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:101::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Sat, 09 Dec 2023 20:30:22 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Sat, 16 Dec 2023 20:30:22 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame BB16 2 KB
2 KB 238ms
98ms Script
text/html 13.42.211.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=52738500116718204444554012533015&nw=1
Requested by: Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.211.181 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-211-181.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 809efca827edde4a13d4ad27695e0eb760530258e61d75bf627d4685db723655

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
last-modified: Sat, 09 Dec 2023 20:30:22 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Sat, 09 Dec 2023 20:31:22 GMT

GET
H2

200

activityi;dc_pre=CO7N34-Zg4MDFdVQkQUdVBUL_A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7418083306675.451 Show response
8019191.fls.doubleclick.net/ Frame 722C
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7418083306675.451?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CO7N34-Zg4MDFdVQkQUdVBUL_A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7418083306675.451?

391 B
326 B

87ms
86ms

Document
text/html

142.250.186.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CO7N34-Zg4MDFdVQkQUdVBUL_A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7418083306675.451?

Requested by

Host: game.gnlore.com
URL: https://game.gnlore.com/victoria-3-product/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f6.1e100.net

Software

cafe /

Resource Hash

b6d74b429abd37ef5d280a197bb997fb44c481397e73fe794b10eccf5ba53d5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 20:30:23 GMT
expires: Sat, 09 Dec 2023 20:30:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 20:30:22 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CO7N34-Zg4MDFdVQkQUdVBUL_A;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7418083306675.451?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900015.redintelligence.net/ Frame F2E7 7 KB
2 KB 118ms
40ms Document
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request_content.php?s=52738500116718204444554012533015&a=e50661b8
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=7bc9cee0c8&subid=&uid=5c3a6f198a612c3a&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC49SBXc50ZcThGKaC1fAP-emvEKblvaBprZWcp8kP8C4QASCM6pZ-YJWCgICYB8gBCakCYi2If_cOsj6oAwHIA5sEqgT0AU_Qtonc6MgcjJe1DiqUUgR9s7XxVvT21QF0Dj0vetL1j-E4vmcME2_rXv9v91HmIwfIWfPzzfY-BrVm43NMKJl-igGpLeVI53NgnXd3s9vTp7vCrUmoKwVUPtoMpD-YVMFniSnuotoiksIWyDXg6fd_QdYDBFGEwNQm1N5f2jj1QKV3LZd4LaqJNL0D85YOybHsEfvthn7g-vnKnGo3RmglgX812yVrmenKW4M1oSgcendI-nKlE9KrIDktZXsB5xhY07UU7NSNwL2NbgNjPlmeC2z2NBo-a4zSBn3Gr1fQ-VvRylcKsNrUuXFCASkksZ74bHLABOuP_I73A-AEA4gF76-WiD6QBgGgBk2AB6yt9Z8DqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYtOKCj5mDgwOACgGYCwHICwGADAGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQKqDQJERbATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSPADICaaNVpt962NCY0QpJC-aJtGNYrqWgKXS_8CEIBL07E8IS0lWP7efHweKltlkCDSrMKOGRNxmE79KUhgB%26sig%3DAOD64_2vFgcAiqvR5lryku98cOn5AMfedg%26client%3Dca-pub-2612637296234729%26dbm_c%3DAKAmf-BiXpH6QfzlnUzjj6GaDXauxP0YT_mooCiw6hw9MUAjLt-l8OZWWBRQht9WQAOFnpjpfEwlriEH8LYevd2Wd6qTnbac8wVsQ-7Rb_GHrn_9BcC2m3uOvAqyshSpH1HHoygGq9yHeb9sRYHeak6lk-8SKQxv7zf3QUmA8fEXS7qUYmcOSBI%26cry%3D1%26dbm_d%3DAKAmf-DmqDrg0Yosop6hItrqFwoLRi6L8te0NWMKEUiPHwpYBwpOUSgu_mOHpFjjKebrok08D-oDDSLWL75XqkxMSJu0pM-g26hUQU2S4j2CKDcJ1WSgdgm-0XHykbTE375driNSAKYQfpK07HaKJPCV_HLo_CMT5xFImDqZ3mTqMPII3Vq-2GJhYPNkUpOYTlHza_TKtyAga1Acffl0ZsoFpfsbfyD5a1q2EvmYDMMTFi_cetRwJ8OP0PIFT8CFmiKJ-xoPkUiPV60-8GAW_7E28Ipyd--tAECKem2F4KOUaRM6Ko6eSo5RTlJyAc5PyfzRpCnGoEcsVqcamZrX-E7SE9rgNvfYYR9g5jS-j47nt3x-CnYuWFkhTKUDkdr_nM5VegVSSHUZ_RMLXzO56i82--6XzZDeZCGlBR073Wo5XZDPDdY5T-fUNd6vq_28n67G22DJeWBI4LMEig3xVcuOAtihMN2phFbIEtcpamJTFallCTrSzWLHXV76k10mpj0yhMoRuhYvCU9ni9RU9Z6A2HW-dOo2zA%26adurl%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-2612637296234729%26output%3Dhtml%26h%3D250%26adk%3D1386011911%26adf%3D3310370695%26pi%3Dt.aa~a.3704686030~rp.1%26w%3D333%26fwrn%3D4%26fwrnh%3D100%26lmt%3D1702153821%26rafmt%3D1%26to%3Dqs%26pwprc%3D6114872683%26format%3D333x250%26url%3Dhttps%253A%252F%252Fgame.gnlore.com%252Fvictoria-3-product%252F%26ea%3D0%26fwr%3D0%26pra%3D3%26rpe%3D1%26resp_fmts%3D3%26wgl%3D1%26fa%3D40%26uach%3DWyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.%26dt%3D1702153821343%26bpp%3D1%26bdt%3D2418%26idt%3D-M%26shv%3Dr20231206%26mjsv%3Dm202312050101%26ptt%3D9%26saldr%3Daa%26abxe%3D1%26prev_fmts%3D0x0%252C1200x280%252C333x250%252C333x250%252C333x250%252C333x250%26nras%3D7%26correlator%3D976130164160%26frm%3D20%26pv%3D1%26ga_vid%3D1605096954.1702153820%26ga_sid%3D1702153820%26ga_hid%3D1713484531%26ga_fc%3D1%26u_tz%3D60%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D1037%26ady%3D3626%26biw%3D1600%26bih%3D1200%26scr_x%3D0%26scr_y%3D0%26eid%3D44759875%252C44759926%252C95320238%252C31079920%252C44807751%252C95320884%252C21065725%26oid%3D2%26pvsid%3D3915279353731801%26tmod%3D1996945669%26uas%3D0%26nvt%3D1%26fc%3D1920%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C1600%252C1200%26vis%3D1%26rsz%3D%257C%257Cs%257C%26abl%3DNS%26fu%3D128%26bc%3D31%26psd%3DW251bGwsbnVsbCxudWxsLDNd%26ifi%3D7%26uci%3Da!7%26btvi%3D5%26fsb%3D1%26dtd%3D23&ancestorOrigins=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Chttps%3A%2F%2Fgame.gnlore.com&random=3783825617135&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 St. Ingbert, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d1291eeeb3979d422f7a9b28754d55b446a0c27d470a195171e7f6b18bada3d6

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2067
Content-Type: text/html; charset=utf-8
Date: Sat, 09 Dec 2023 20:30:22 GMT
Expires: Sat, 09 Dec 2023 20:30:22 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H2

200

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame BB16
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=52738500116718204444554012533015&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=52738500116718204444554012533015&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
360 B

50ms
50ms

Image
image/gif

91.121.248.44
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=52738500116718204444554012533015&t=htlp&gdpr=1&consent=1&gdpr_consent=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
Protocol: H2
Server: 91.121.248.44 , France, ASN16276 (OVH, FR),
Reverse DNS: ip44.ip-91-121-248.eu
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx
host: pv.medialead.de
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=52738500116718204444554012533015&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Sat, 09 Dec 2023 20:30:22 GMT
server: nginx
content-length: 138
content-type: text/html

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0B29 1 KB
643 B 42ms
39ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 15132
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 09 Dec 2023 16:18:10 GMT
etag: 48472445140208031
expires: Sun, 10 Dec 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame BB16 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f55c2edef40de5c0f5a90ab54c9b28131d97a46d13cefefde4a7aac4b4b8014

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 20C1 39 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 14:01:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23330
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Dec 2024 14:01:32 GMT

GET
H2 451 466606.gif
id.rlcdn.com/ Frame 0B29 0
98 B 148ms
48ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DAXcoOmRPPuKPArupj1zfV-bcCtSDs7AnjAOit4yaOnNzK7V88IGb1nE2LhdFXm196QWk-tosToYmx3iZuTA2ngDACAGMcN82XnRt&google_gid=CAESEE46TFXiziRGf0GIhdKbeGQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame 0B29 43 B
145 B 42ms
40ms Image
image/gif 35.156.190.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESECzDVY8i_U3k0t6I4bbmzDw&google_cver=1&google_push=AXcoOmQiZUnNopc1Nk91zXXTRhwjSUrEsMgnnHvHviLIQswyhhnMCboAvcDvABy_XJP86_i_ceWlF7a7dH9uDLRcn-YwY5QJbPnISQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.156.190.4 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-156-190-4.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0B29
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmQKvHDT...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAXcoOmQKvHDT...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzEyMDkyMDMwMjMwMDAxMzMxODQyMDA0MA%3D%3D&google_push=AXcoOmQKvHDTYwVzFF1itxyHLcqFt4l3Km6GYbW_MOh4O4psx8I6Q967-5koDcsNiwsiBZ...

170 B
188 B

49ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzEyMDkyMDMwMjMwMDAxMzMxODQyMDA0MA%3D%3D&google_push=AXcoOmQKvHDTYwVzFF1itxyHLcqFt4l3Km6GYbW_MOh4O4psx8I6Q967-5koDcsNiwsiBZWKuE-76oR_RHMcWRRa4yBPCwPQI1Dazg

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMzEyMDkyMDMwMjMwMDAxMzMxODQyMDA0MA%3D%3D&google_push=AXcoOmQKvHDTYwVzFF1itxyHLcqFt4l3Km6GYbW_MOh4O4psx8I6Q967-5koDcsNiwsiBZWKuE-76oR_RHMcWRRa4yBPCwPQI1Dazg
pragma: no-cache
date: Sat, 09 Dec 2023 20:30:23 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Sat, 09 Dec 2023 20:30:23 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0B29
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKEOX1kI6CEqKqdWHQP46Wo&google_cver=1&google_push=AXcoOmSjboCuyjnOaV7BWx3tvVjdVUmBDwkwazDV0QFIE_SUd0fumyhp-drtLXXbHnQnyW2zWl7YORH1...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKEOX1kI6CEqKqdWHQP46Wo&google_cver=1&google_push=AXcoOmSjboCuyjnOaV7BWx3tvVjdVUmBDwkwazDV0QFIE_SUd0fumyhp-drtLXXbHnQnyW2zWl7...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE2ODIxMzg0NjU0MDgyNTM1NQ&google_push=AXcoOmSjboCuyjnOaV7BWx3tvVjdVUmBDwkwazDV0QFIE_SUd0fumyhp-drtLXXbHnQnyW2zWl7YOR...

170 B
188 B

50ms
50ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE2ODIxMzg0NjU0MDgyNTM1NQ&google_push=AXcoOmSjboCuyjnOaV7BWx3tvVjdVUmBDwkwazDV0QFIE_SUd0fumyhp-drtLXXbHnQnyW2zWl7YORH1sIlGvrXjvORo5AkuVgEtxw

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE2ODIxMzg0NjU0MDgyNTM1NQ&google_push=AXcoOmSjboCuyjnOaV7BWx3tvVjdVUmBDwkwazDV0QFIE_SUd0fumyhp-drtLXXbHnQnyW2zWl7YORH1sIlGvrXjvORo5AkuVgEtxw
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 0B29 42 B
204 B 158ms
49ms Image
image/gif 34.160.236.64
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESENxSAsZS8S8sBcC9VXSCoM4&google_push=AXcoOmQ6Nu44qskXesDFSFwYKxihp2SLdh4ViSUCYwaTdZnL3iq36dObh4wsO13fNK1Jrg2fkknj7UN1uXm2PMeKBLnzTvEYVbWh&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.160.236.64 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 64.236.160.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 20:30:22 GMT
via: 1.1 google
last-modified: Thu, 19 Oct 2023 06:07:48 GMT
server: nginx
etag: "6530c7b4-2a"
content-type: image/gif
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

GET
H2 200 trk
ag.innovid.com/ Frame 0B29 43 B
297 B 309ms
48ms Image
image/gif 2a05:d01c:1d8:8102:1dbb:a7d1:23ff:c9b8
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEMToJ-hwT0m2Nv7jQvopZgU&google_cver=1&google_push=AXcoOmQTfega3hu1TQ1b7mzUUi9uhoX6BWX7nMTcOqXW6A1MU1LKguYAooiXe79NfPn2uc5MnmA1M5PllSxLJ7xpI5HvTG9TcOiWtw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2612637296234729&output=html&h=250&adk=1386011911&adf=3310370695&pi=t.aa~a.3704686030~rp.1&w=333&fwrn=4&fwrnh=100&lmt=1702153821&rafmt=1&to=qs&pwprc=6114872683&format=333x250&url=https%3A%2F%2Fgame.gnlore.com%2Fvictoria-3-product%2F&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1702153821343&bpp=1&bdt=2418&idt=-M&shv=r20231206&mjsv=m202312050101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280%2C333x250%2C333x250%2C333x250%2C333x250&nras=7&correlator=976130164160&frm=20&pv=1&ga_vid=1605096954.1702153820&ga_sid=1702153820&ga_hid=1713484531&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1037&ady=3626&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C95320238%2C31079920%2C44807751%2C95320884%2C21065725&oid=2&pvsid=3915279353731801&tmod=1996945669&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=23
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:1dbb:a7d1:23ff:c9b8 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 09 Dec 2023 20:30:23 GMT
cache-control: no-cache
content-length: 43
request-time: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0B29
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEBGac8aWKaPKqLrunOjkp1s&google_cver=1&google_push=AXcoOmRdsRzLbtn75Ao4FIJhEC9_HRI16GPbxp49PFM27rrIBSwe3Ha36OHTVNVEK_sPc1zbdNcSuhvfoM25...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRdsRzLbtn75Ao4FIJhEC9_HRI16GPbxp49PFM27rrIBSwe3Ha36OHTVNVEK_sPc1zbdNcSuhvfoM25Ivzv2udBnkOuqBP2pA

170 B
188 B

49ms
48ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRdsRzLbtn75Ao4FIJhEC9_HRI16GPbxp49PFM27rrIBSwe3Ha36OHTVNVEK_sPc1zbdNcSuhvfoM25Ivzv2udBnkOuqBP2pA

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:30:22 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmRdsRzLbtn75Ao4FIJhEC9_HRI16GPbxp49PFM27rrIBSwe3Ha36OHTVNVEK_sPc1zbdNcSuhvfoM25Ivzv2udBnkOuqBP2pA
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0B29 0
12 B 47ms
46ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JVIQv1tkysfJNEa5tsHA2DhwxtsCxV8fUzU9k2hrG-kyofXNPGkfJ3nerqNER_UvMatw4S

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS