www.visajourney.com Open in urlscan Pro
207.58.140.165 Public Scan

Software

Resource Hash

279a89395abc5a049d772b419aff07b25beb2709099c927aa634776110e61a9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:46 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rtbsspub
xch.media.net/AdExchange/ 61 KB
4 KB 62ms
27ms EventSource
text/event-stream 34.107.136.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xch.media.net/AdExchange/rtbsspub?&prvReqId=18470609968977801685539726958&gdpr=1&gdprconsent=0&cid=8CU2CYR88&itype=HB&ptrid=8PRW23HG5&sd=1&requestString=206617866*236%7C728x90~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40206617866*237%7C728x90~300x250%7C8CU2CYR88%7C206617866_8CU2CYR88~206617866_8CU2CYR88%7C%7C%7C1%40206617866*251%7C728x90~300x250%7C8CU2CYR88%7C206617866_8CU2CYR88~206617866_8CU2CYR88%7C%7C%7C1%40206617866*2022%7C728x90~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40206617866*3007%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C206617866_8CU2CYR88~206617866_8CU2CYR88%7C%7C%7C3%40206617866*3017%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C206617866_8CU2CYR88~206617866_8CU2CYR88%7C%7C%7C3%40267730264*122%7C300x250%7C8CU2CYR88%7C8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40267730264*141%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C3%40267730264*175%7C300x250%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C1%40267730264*203%7C300x250%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C1%40267730264*214%7C300x250%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C1%40267730264*222%7C300x250%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C1%40267730264*233%7C300x250%7C19396%7C353028_1877750_15%7C%7C%7C1%40267730264*236%7C300x250%7C159463%7C3263727_770504%7C%7C%7C1%40267730264*237%7C300x250%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C1%40267730264*251%7C300x250%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C1%40267730264*2022%7C300x250%7C537100188%7C540552573%7C%7C%7C1%40267730264*3007%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C3%40267730264*3017%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C3%40411143857*122%7C300x250%7C8CU2CYR88%7C8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40411143857*141%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C3%40411143857*175%7C320x100~300x250%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C1%40411143857*203%7C320x100~300x250%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C1%40411143857*214%7C320x100~300x250%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C1%40411143857*222%7C320x100~300x250%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C1%40411143857*233%7C320x100~300x250%7C19396%7C353028_1877750_117~353028_1877750_15%7C%7C%7C1%40411143857*236%7C320x100~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40411143857*237%7C320x100~300x250%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C1%40411143857*251%7C320x100~300x250%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C1%40411143857*2022%7C320x100~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40411143857*3007%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C3%40411143857*3017%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C3%40419517414*55%7C728x90~300x250%7C537100188%7C540916825~540916826%7C%7C%7C1%40419517414*122%7C728x90~300x250%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu~8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40419517414*141%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C3%40419517414*175%7C728x90~300x250%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C1%40419517414*203%7C728x90~300x250%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C1%40419517414*214%7C728x90~300x250%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C1%40419517414*222%7C728x90~300x250%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C1%40419517414*233%7C300x250~728x90%7C19396%7C353028_1877750_15~353028_1877750_2%7C%7C%7C1%40419517414*236%7C728x90~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40419517414*237%7C728x90~300x250%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C1%40419517414*251%7C728x90~300x250%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C1%40419517414*2022%7C728x90~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40419517414*3007%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C3%40419517414*3017%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C3%40435351148*55%7C728x90~300x250%7C537100188%7C540916825~540916826%7C%7C%7C1%40435351148*122%7C728x90~300x250%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu~8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40435351148*141%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C3%40435351148*175%7C728x90~300x250%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C1&bl=1&hlt=1&ndec=1&region=nv&rt=5&tr=0.4468842505623052&tscode=1&crid=206617866%2C267730264%2C411143857%2C419517414%2C435351148&adt=desktop&scrsize=1600x1200&ugd=4&dn=https%3A%2F%2Fwww.visajourney.com&https=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&pageinfo=%7B%22ph%22%3A1200%2C%22vh%22%3A1200%2C%22vw%22%3A1600%7D&act=headerBid&cc=DE&ct=FRANKFURT&rc=HE&usp_enf=1&usp_status=0&rtusuid=%7B%7D&ssa=1&prid=8PRVCXX19&coppa=0&isRefresh=0&taginfo=%7B%22114551746%22%3A%7B%7D%2C%22168288438%22%3A%7B%7D%2C%22182368346%22%3A%7B%7D%2C%22206617866%22%3A%7B%7D%2C%22267730264%22%3A%7B%7D%2C%22411143857%22%3A%7B%7D%2C%22419517414%22%3A%7B%7D%2C%22435351148%22%3A%7B%7D%2C%22448433316%22%3A%7B%7D%2C%22487582194%22%3A%7B%7D%2C%22544260912%22%3A%7B%7D%2C%22595360876%22%3A%7B%7D%2C%22740248112%22%3A%7B%7D%2C%22766521243%22%3A%7B%7D%7D&encryptionVersion=0.0&switch=1

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.136.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

34a709ba536bfde40096dd009359b3014f51869ed045aade859a0180abb20574

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:46 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rtbsspub
xch.media.net/AdExchange/ 70 KB
4 KB 67ms
32ms EventSource
text/event-stream 34.107.136.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xch.media.net/AdExchange/rtbsspub?&prvReqId=68389231188907411685539726959&gdpr=1&gdprconsent=0&cid=8CU2CYR88&itype=HB&ptrid=8PRW23HG5&sd=1&requestString=435351148*203%7C728x90~300x250%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C1%40435351148*214%7C728x90~300x250%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C1%40435351148*222%7C728x90~300x250%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C1%40435351148*233%7C300x250~728x90%7C19396%7C353028_1877750_15~353028_1877750_2%7C%7C%7C1%40435351148*236%7C728x90~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40435351148*237%7C728x90~300x250%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C1%40435351148*251%7C728x90~300x250%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C1%40435351148*2022%7C728x90~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40435351148*3007%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C3%40435351148*3017%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C3%40448433316*55%7C728x90~300x250%7C537100188%7C540916825~540916826%7C%7C%7C1%40448433316*122%7C728x90~300x250%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu~8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40448433316*141%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C3%40448433316*175%7C728x90~300x250%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C1%40448433316*203%7C728x90~300x250%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C1%40448433316*214%7C728x90~300x250%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C1%40448433316*222%7C728x90~300x250%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C1%40448433316*233%7C300x250~728x90%7C19396%7C353028_1877750_15~353028_1877750_2%7C%7C%7C1%40448433316*236%7C728x90~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40448433316*237%7C728x90~300x250%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C1%40448433316*251%7C728x90~300x250%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C1%40448433316*2022%7C728x90~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40448433316*3007%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C3%40448433316*3017%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C3%40487582194*55%7C728x90~300x250%7C537100188%7C540916825~540916826%7C%7C%7C1%40487582194*122%7C728x90~300x250%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu~8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40487582194*141%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C3%40487582194*175%7C728x90~300x250%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C1%40487582194*203%7C728x90~300x250%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C1%40487582194*214%7C728x90~300x250%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C1%40487582194*222%7C728x90~300x250%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C1%40487582194*233%7C300x250~728x90%7C19396%7C353028_1877750_15~353028_1877750_2%7C%7C%7C1%40487582194*236%7C728x90~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40487582194*237%7C728x90~300x250%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C1%40487582194*251%7C728x90~300x250%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C1%40487582194*2022%7C728x90~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40487582194*3007%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C3%40487582194*3017%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C3%40544260912*55%7C728x90~320x50%7C537100188%7C540916825~540916826%7C%7C%7C1%40544260912*122%7C728x90%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu%7C%7C%7C1%40544260912*141%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C3%40544260912*175%7C320x100~728x90~320x50%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C1%40544260912*203%7C320x100~728x90~320x50%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C1%40544260912*214%7C320x100~728x90~320x50%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C1%40544260912*222%7C320x100~728x90~320x50%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C1%40544260912*233%7C320x100~320x50~728x90%7C19396%7C353028_1877750_117~353028_1877750_43~353028_1877750_2%7C%7C%7C1%40544260912*236%7C320x100~728x90~320x50%7C159463%7C3263727_770504~3263727_770504~3263727_770504%7C%7C%7C1%40544260912*237%7C320x100~728x90~320x50%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C1%40544260912*251%7C320x100~728x90~320x50%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C1%40544260912*2022%7C320x100~728x90~320x50%7C537100188%7C540552573~540552573~540552573%7C%7C%7C1&bl=1&hlt=1&ndec=1&region=nv&rt=5&tr=0.36064786097583834&tscode=1&crid=435351148%2C448433316%2C487582194%2C544260912&adt=desktop&scrsize=1600x1200&ugd=4&dn=https%3A%2F%2Fwww.visajourney.com&https=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&pageinfo=%7B%22ph%22%3A1200%2C%22vh%22%3A1200%2C%22vw%22%3A1600%7D&act=headerBid&cc=DE&ct=FRANKFURT&rc=HE&usp_enf=1&usp_status=0&rtusuid=%7B%7D&ssa=1&prid=8PRVCXX19&coppa=0&isRefresh=0&taginfo=%7B%22114551746%22%3A%7B%7D%2C%22168288438%22%3A%7B%7D%2C%22182368346%22%3A%7B%7D%2C%22206617866%22%3A%7B%7D%2C%22267730264%22%3A%7B%7D%2C%22411143857%22%3A%7B%7D%2C%22419517414%22%3A%7B%7D%2C%22435351148%22%3A%7B%7D%2C%22448433316%22%3A%7B%7D%2C%22487582194%22%3A%7B%7D%2C%22544260912%22%3A%7B%7D%2C%22595360876%22%3A%7B%7D%2C%22740248112%22%3A%7B%7D%2C%22766521243%22%3A%7B%7D%7D&encryptionVersion=0.0&switch=1

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.136.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

6a32535292c6bd22ff8d1775dde7becb135170b3dd24ddc82ed8a8380daa474b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rtbsspub
xch.media.net/AdExchange/ 53 KB
3 KB 62ms
27ms EventSource
text/event-stream 34.107.136.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xch.media.net/AdExchange/rtbsspub?&prvReqId=14462862828272361685539726959&gdpr=1&gdprconsent=0&cid=8CU2CYR88&itype=HB&ptrid=8PRW23HG5&sd=1&requestString=544260912*3007%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C3%40544260912*3017%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C3%40595360876*55%7C728x90~300x250%7C537100188%7C540916825~540916826%7C%7C%7C1%40595360876*122%7C728x90~300x250%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu~8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40595360876*141%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C3%40595360876*175%7C728x90~300x250%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C1%40595360876*203%7C728x90~300x250%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C1%40595360876*214%7C728x90~300x250%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C1%40595360876*222%7C728x90~300x250%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C1%40595360876*233%7C300x250~728x90%7C19396%7C353028_1877750_15~353028_1877750_2%7C%7C%7C1%40595360876*236%7C728x90~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40595360876*237%7C728x90~300x250%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C1%40595360876*251%7C728x90~300x250%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C1%40595360876*2022%7C728x90~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40595360876*3007%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C3%40595360876*3017%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C3%40740248112*55%7C728x90~300x250%7C537100188%7C540916825~540916826%7C%7C%7C1%40740248112*122%7C728x90~300x250%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu~8CU2CYR88_c7SxzJUzcfowZzRpyi9BSQxR%7C%7C%7C1%40740248112*141%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C3%40740248112*175%7C728x90~300x250%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C1%40740248112*203%7C728x90~300x250%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C1%40740248112*214%7C728x90~300x250%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C1%40740248112*222%7C728x90~300x250%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C1%40740248112*233%7C300x250~728x90%7C19396%7C353028_1877750_15~353028_1877750_2%7C%7C%7C1%40740248112*236%7C728x90~300x250%7C159463%7C3263727_770504~3263727_770504%7C%7C%7C1%40740248112*237%7C728x90~300x250%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C1%40740248112*251%7C728x90~300x250%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C1%40740248112*2022%7C728x90~300x250%7C537100188%7C540552573~540552573%7C%7C%7C1%40740248112*3007%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C3%40740248112*3017%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C3%40766521243*55%7C728x90%7C537100188%7C540916825%7C%7C%7C1%40766521243*122%7C728x90%7C8CU2CYR88%7C8CU2CYR88_7Cakqbh8MdCXv45GqoArf5Bu%7C%7C%7C1%40766521243*141%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C3%40766521243*175%7C728x90%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C1%40766521243*203%7C728x90%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C1%40766521243*214%7C728x90%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C1%40766521243*222%7C728x90%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C1%40766521243*233%7C728x90%7C19396%7C353028_1877750_2%7C%7C%7C1%40766521243*236%7C728x90%7C159463%7C3263727_770504%7C%7C%7C1%40766521243*237%7C728x90%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C1%40766521243*251%7C728x90%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C1%40766521243*2022%7C728x90%7C537100188%7C540552573%7C%7C%7C1%40766521243*3007%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C3%40766521243*3017%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C3&bl=1&hlt=1&ndec=1&region=nv&rt=5&tr=0.3508042139816083&tscode=1&crid=544260912%2C595360876%2C740248112%2C766521243&adt=desktop&scrsize=1600x1200&ugd=4&dn=https%3A%2F%2Fwww.visajourney.com&https=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&pageinfo=%7B%22ph%22%3A1200%2C%22vh%22%3A1200%2C%22vw%22%3A1600%7D&act=headerBid&cc=DE&ct=FRANKFURT&rc=HE&usp_enf=1&usp_status=0&rtusuid=%7B%7D&ssa=1&prid=8PRVCXX19&coppa=0&isRefresh=0&taginfo=%7B%22114551746%22%3A%7B%7D%2C%22168288438%22%3A%7B%7D%2C%22182368346%22%3A%7B%7D%2C%22206617866%22%3A%7B%7D%2C%22267730264%22%3A%7B%7D%2C%22411143857%22%3A%7B%7D%2C%22419517414%22%3A%7B%7D%2C%22435351148%22%3A%7B%7D%2C%22448433316%22%3A%7B%7D%2C%22487582194%22%3A%7B%7D%2C%22544260912%22%3A%7B%7D%2C%22595360876%22%3A%7B%7D%2C%22740248112%22%3A%7B%7D%2C%22766521243%22%3A%7B%7D%7D&encryptionVersion=0.0&switch=1

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.136.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

f9294fe6249337e616367b9ce3fb5257b8dcca0cce996edc90f67efebe391488

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:46 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rtbsspub
xch.media.net/AdExchange/ 46 KB
3 KB 58ms
24ms EventSource
text/event-stream 34.107.136.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xch.media.net/AdExchange/rtbsspub?&prvReqId=76027659644392921685539726962&gdpr=1&gdprconsent=0&cid=8CU2CYR88&itype=HB&ptrid=8PRW23HG5&sd=1&requestString=114551746*97%7C320x100~728x90~320x50%7C8CU2CYR88%7C114551746_8CU2CYR88~114551746_8CU2CYR88~114551746_8CU2CYR88%7C%7C%7C1%40114551746*108%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C114551746_8CU2CYR88~114551746_8CU2CYR88~114551746_8CU2CYR88%7C%7C%7C3%40114551746*3012%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C114551746_8CU2CYR88~114551746_8CU2CYR88~114551746_8CU2CYR88%7C%7C%7C3%40168288438*97%7C320x100~728x90~300x250~160x600~320x50%7C8CU2CYR88%7C168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88%7C%7C%7C1%40168288438*108%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88%7C%7C%7C3%40168288438*3012%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88~168288438_8CU2CYR88%7C%7C%7C3%40182368346*97%7C728x90~300x250%7C8CU2CYR88%7C182368346_8CU2CYR88~182368346_8CU2CYR88%7C%7C%7C1%40182368346*108%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C182368346_8CU2CYR88~182368346_8CU2CYR88%7C%7C%7C3%40182368346*3012%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C182368346_8CU2CYR88~182368346_8CU2CYR88%7C%7C%7C3%40206617866*97%7C728x90~300x250%7C8CU2CYR88%7C206617866_8CU2CYR88~206617866_8CU2CYR88%7C%7C%7C1%40206617866*108%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C206617866_8CU2CYR88~206617866_8CU2CYR88%7C%7C%7C3%40206617866*3012%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C206617866_8CU2CYR88~206617866_8CU2CYR88%7C%7C%7C3%40267730264*97%7C300x250%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C1%40267730264*108%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C3%40267730264*3012%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C267730264_8CU2CYR88%7C%7C%7C3%40411143857*97%7C320x100~300x250%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C1%40411143857*108%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C3%40411143857*3012%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C411143857_8CU2CYR88~411143857_8CU2CYR88%7C%7C%7C3%40419517414*97%7C728x90~300x250%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C1%40419517414*108%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C3%40419517414*3012%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C419517414_8CU2CYR88~419517414_8CU2CYR88%7C%7C%7C3%40435351148*97%7C728x90~300x250%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C1%40435351148*108%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C3%40435351148*3012%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C435351148_8CU2CYR88~435351148_8CU2CYR88%7C%7C%7C3%40448433316*97%7C728x90~300x250%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C1%40448433316*108%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C3%40448433316*3012%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C448433316_8CU2CYR88~448433316_8CU2CYR88%7C%7C%7C3%40487582194*97%7C728x90~300x250%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C1%40487582194*108%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C3%40487582194*3012%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C487582194_8CU2CYR88~487582194_8CU2CYR88%7C%7C%7C3%40544260912*97%7C320x100~728x90~320x50%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C1%40544260912*108%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C3%40544260912*3012%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C544260912_8CU2CYR88~544260912_8CU2CYR88~544260912_8CU2CYR88%7C%7C%7C3%40595360876*97%7C728x90~300x250%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C1%40595360876*108%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C3%40595360876*3012%7C1x1_TC59MJ7_1%7C8CU2CYR88%7C595360876_8CU2CYR88~595360876_8CU2CYR88%7C%7C%7C3%40740248112*97%7C728x90~300x250%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C1%40740248112*108%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C3%40740248112*3012%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C740248112_8CU2CYR88~740248112_8CU2CYR88%7C%7C%7C3%40766521243*97%7C728x90%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C1%40766521243*108%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C3%40766521243*3012%7C1x1_T9VJI4H_1%7C8CU2CYR88%7C766521243_8CU2CYR88%7C%7C%7C3&bl=1&hlt=1&ndec=1&region=nv&rt=5&tr=0.26318486099255&tscode=1&crid=114551746%2C168288438%2C182368346%2C206617866%2C267730264%2C411143857%2C419517414%2C435351148%2C448433316%2C487582194%2C544260912%2C595360876%2C740248112%2C766521243&adt=desktop&scrsize=1600x1200&ugd=4&dn=https%3A%2F%2Fwww.visajourney.com&https=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&pageinfo=%7B%22ph%22%3A1200%2C%22vh%22%3A1200%2C%22vw%22%3A1600%7D&act=headerBid&cc=DE&ct=FRANKFURT&rc=HE&usp_enf=1&usp_status=0&rtusuid=%7B%7D&ssa=1&prid=8PRVCXX19&coppa=0&isRefresh=0&taginfo=%7B%22114551746%22%3A%7B%7D%2C%22168288438%22%3A%7B%7D%2C%22182368346%22%3A%7B%7D%2C%22206617866%22%3A%7B%7D%2C%22267730264%22%3A%7B%7D%2C%22411143857%22%3A%7B%7D%2C%22419517414%22%3A%7B%7D%2C%22435351148%22%3A%7B%7D%2C%22448433316%22%3A%7B%7D%2C%22487582194%22%3A%7B%7D%2C%22544260912%22%3A%7B%7D%2C%22595360876%22%3A%7B%7D%2C%22740248112%22%3A%7B%7D%2C%22766521243%22%3A%7B%7D%7D&encryptionVersion=0.0&switch=1

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.136.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

1d113a7327dba8337350f5deb420b9ed8b2f61965ae04ca02b1b682f7e530d17

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:46 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305250101/ 350 KB
118 KB 75ms
74ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305250101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3407508467788263&plah=www.visajourney.com&bust=31074966

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5fd2ffdc2e0058d0807c3c62711ee834b258eb8d6c094c6633a807b1f6b7ac2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 120488
x-xss-protection: 0
server: cafe
etag: 13307573475958702295
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:47 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230525/r20190131/ Frame 3F08 10 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230525/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 50275
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 23:30:52 GMT
etag: 15057649708203361565
expires: Tue, 13 Jun 2023 23:30:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 75 KB
25 KB 84ms
61ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: hbx.media.net
URL: https://hbx.media.net/bidexchange.js?cid=8CU2CYR88&dn=www.visajourney.com&https=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0bded9129f29f09ae7be7a1f68b7d6b83fb02478e1e2682231fd6a126bc43409

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25187
x-xss-protection: 0
server: cafe
etag: 416 / 19508 / m202305250101 / config-hash: 5672104783884740629
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:47 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 79ms
45ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-51274997-1&cid=1806750341.1685539727&jid=1019950348&_u=IGBAgAABAAAAAEAAI~&z=551329709

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 55ms
54ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-51274997-1&cid=1806750341.1685539727&jid=1019950348&_u=IGBAgAABAAAAAEAAI~&z=551329709

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/969675719/ 42 B
154 B 21ms
20ms Image
image/gif 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/969675719/?random=1685539726982&cv=11&fst=1685538000000&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&frm=0&tiba=nflow3%20-%20VisaJourney&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3379037754&rmt_tld=0&ipr=y

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/969675719/ 42 B
64 B 21ms
21ms Image
image/gif 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/969675719/?random=1685539726982&cv=11&fst=1685538000000&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&frm=0&tiba=nflow3%20-%20VisaJourney&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3379037754&rmt_tld=1&ipr=y

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 log
hblg.media.net/ 35 B
191 B 188ms
14ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfk&evtid=belog&itype=HB&tElp=433&adt=desktop&cid=8CU2CYR88&ct=FRANKFURT&cc=DE&ugd=4&app=0&pht=1200&pid=8PRW23HG5&dn=visajourney.com&servname=ssp-serving-744d67f998-pjc42&svr=053011_653_053011_615_ssp&sc=HE&version=4&vh=1200&vw=1600&vsid=&vid=00001685539726873036448888326897&sspAbBucket=CONTROL&lw=1&dapp=green&itypeid=1&sd=1&adbd=0&npa=0&gdpr_enf=1&csex=0&gdfstr=Y-N&gdpr=1&csstr=&tcf_cmp=&tcf_status=&tcf_prp=&suc=0&tcf_api=0&usp_enf=1&usp_status=0&usp_ldf=&usp_string=&ufca=-1&coppa_status=&coppa_applied=&id_details=&abte=SSP_CLIENT&rtype=&lbr=1&mnkv=&pabte=&pc=&ccat=&floc_id=&floc_ver=&gfundl=500&gtd=200&inid=&ngfundl=700&rdl=700&name=TEMPLATE_UNAVAILABLE_IN_FRAMEWORK_FOR_114551746_FOR_320x100&stack=NONE&lvl=3&crid=114551746&pvid=&dfpDiv=&liid=&dfpBd=&acid=&rctr=&sz=&t_cntdwn=&t_ciel=&lper=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&kwrf=

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Wed, 31 May 2023 13:28:47 GMT

GET
H2 200 log
hblg.media.net/ 35 B
191 B 187ms
13ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfk&evtid=belog&itype=HB&tElp=434&adt=desktop&cid=8CU2CYR88&ct=FRANKFURT&cc=DE&ugd=4&app=0&pht=1200&pid=8PRW23HG5&dn=visajourney.com&servname=ssp-serving-744d67f998-pjc42&svr=053011_653_053011_615_ssp&sc=HE&version=4&vh=1200&vw=1600&vsid=&vid=00001685539726873036448888326897&sspAbBucket=CONTROL&lw=1&dapp=green&itypeid=1&sd=1&adbd=0&npa=0&gdpr_enf=1&csex=0&gdfstr=Y-N&gdpr=1&csstr=&tcf_cmp=&tcf_status=&tcf_prp=&suc=0&tcf_api=0&usp_enf=1&usp_status=0&usp_ldf=&usp_string=&ufca=-1&coppa_status=&coppa_applied=&id_details=&abte=SSP_CLIENT&rtype=&lbr=1&mnkv=&pabte=&pc=&ccat=&floc_id=&floc_ver=&gfundl=500&gtd=200&inid=&ngfundl=700&rdl=700&name=TEMPLATE_UNAVAILABLE_IN_FRAMEWORK_FOR_168288438_FOR_320x100&stack=NONE&lvl=3&crid=168288438&pvid=&dfpDiv=&liid=&dfpBd=&acid=&rctr=&sz=&t_cntdwn=&t_ciel=&lper=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&kwrf=

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Wed, 31 May 2023 13:28:47 GMT

GET
H2 200 log
hblg.media.net/ 35 B
191 B 189ms
15ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfk&evtid=belog&itype=HB&tElp=437&adt=desktop&cid=8CU2CYR88&ct=FRANKFURT&cc=DE&ugd=4&app=0&pht=1200&pid=8PRW23HG5&dn=visajourney.com&servname=ssp-serving-744d67f998-pjc42&svr=053011_653_053011_615_ssp&sc=HE&version=4&vh=1200&vw=1600&vsid=&vid=00001685539726873036448888326897&sspAbBucket=CONTROL&lw=1&dapp=green&itypeid=1&sd=1&adbd=0&npa=0&gdpr_enf=1&csex=0&gdfstr=Y-N&gdpr=1&csstr=&tcf_cmp=&tcf_status=&tcf_prp=&suc=0&tcf_api=0&usp_enf=1&usp_status=0&usp_ldf=&usp_string=&ufca=-1&coppa_status=&coppa_applied=&id_details=&abte=SSP_CLIENT&rtype=&lbr=1&mnkv=&pabte=&pc=&ccat=&floc_id=&floc_ver=&gfundl=500&gtd=200&inid=&ngfundl=700&rdl=700&name=TEMPLATE_UNAVAILABLE_IN_FRAMEWORK_FOR_411143857_FOR_320x100&stack=NONE&lvl=3&crid=411143857&pvid=&dfpDiv=&liid=&dfpBd=&acid=&rctr=&sz=&t_cntdwn=&t_ciel=&lper=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&kwrf=

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Wed, 31 May 2023 13:28:47 GMT

GET
H2 200 log
hblg.media.net/ 35 B
191 B 188ms
15ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfk&evtid=belog&itype=HB&tElp=438&adt=desktop&cid=8CU2CYR88&ct=FRANKFURT&cc=DE&ugd=4&app=0&pht=1200&pid=8PRW23HG5&dn=visajourney.com&servname=ssp-serving-744d67f998-pjc42&svr=053011_653_053011_615_ssp&sc=HE&version=4&vh=1200&vw=1600&vsid=&vid=00001685539726873036448888326897&sspAbBucket=CONTROL&lw=1&dapp=green&itypeid=1&sd=1&adbd=0&npa=0&gdpr_enf=1&csex=0&gdfstr=Y-N&gdpr=1&csstr=&tcf_cmp=&tcf_status=&tcf_prp=&suc=0&tcf_api=0&usp_enf=1&usp_status=0&usp_ldf=&usp_string=&ufca=-1&coppa_status=&coppa_applied=&id_details=&abte=SSP_CLIENT&rtype=&lbr=1&mnkv=&pabte=&pc=&ccat=&floc_id=&floc_ver=&gfundl=500&gtd=200&inid=&ngfundl=700&rdl=700&name=TEMPLATE_UNAVAILABLE_IN_FRAMEWORK_FOR_544260912_FOR_320x100&stack=NONE&lvl=3&crid=544260912&pvid=&dfpDiv=&liid=&dfpBd=&acid=&rctr=&sz=&t_cntdwn=&t_ciel=&lper=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&kwrf=

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Wed, 31 May 2023 13:28:47 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 176ms
17ms Image
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1641875125894262&ev=PageView&dl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&rl=&if=false&ts=1685539727303&sw=1600&sh=1200&v=2.9.104&r=stable&ec=0&o=30&fbp=fb.1.1685539727302.1476629919&it=1685539726756&coo=false&exp=a1&rqm=GET

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 31 May 2023 13:28:47 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/ 405 KB
125 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f9f532d9791610dfcc4f0902dcac54e5274eec29a675eae9612ad25c4512fbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:03:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8747
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 128027
x-xss-protection: 0
server: cafe
etag: 5295197450709426467
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Thu, 30 May 2024 11:03:00 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 77 B
81 B 57ms
41ms XHR
application/json 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.visajourney.com&ppc_eid=31074776

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f498632750cb34a7ca0e301f3b38166601c59b93374dbfd651f4dc4839b3d46e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57
x-xss-protection: 0
expires: Wed, 31 May 2023 13:28:47 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 397 B
610 B 150ms
23ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.visajourney.com&callback=_gfp_s_&client=ca-pub-3407508467788263

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305250101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-3407508467788263&plah=www.visajourney.com&bust=31074966

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09ed884c8d5cf75cbaa8fbb3841c7611e56bbefae71e2c6185f9bfa7d0e153da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 258
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 123ms
15ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.visajourney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 123ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.visajourney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9D68 243 KB
59 KB 727ms
724ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3407508467788263&output=html&adk=1812271804&adf=3025194257&lmt=1685539714&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685539727156&bpp=8&bdt=864&idt=173&shv=r20230525&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7716786974829&frm=20&pv=2&ga_vid=1806750341.1685539727&ga_sid=1685539727&ga_hid=546175410&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31074966%2C44788442%2C44789923%2C44789818&oid=2&pvsid=4406493206897173&tmod=1918266381&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=208

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1814ab76907d371f3f1767f2078d335f0159907612da1aea2bd3c13999972e22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 60323
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:48 GMT
expires: Wed, 31 May 2023 13:28:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4972 104 KB
37 KB 1135ms
1133ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3407508467788263&output=html&h=280&slotname=1579876115&adk=2600020922&adf=2214028041&pi=t.ma~as.1579876115&w=1198&fwrn=4&fwrnh=100&lmt=1685539714&rafmt=1&format=1198x280&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685539727166&bpp=2&bdt=874&idt=203&shv=r20230525&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7716786974829&frm=20&pv=1&ga_vid=1806750341.1685539727&ga_sid=1685539727&ga_hid=546175410&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=381&ady=420&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31074966%2C44788442%2C44789923%2C44789818&oid=2&pvsid=4406493206897173&tmod=1918266381&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=SFVXnMrwIH&p=https%3A//www.visajourney.com&dtd=209

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d03ad7550dcbd9ad5f2f1ea5af3cd2f95473db63079f7e83c4934974958ba24f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 37777
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:48 GMT
expires: Wed, 31 May 2023 13:28:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 front_front_core.js.1230ff5f5f8d0e9825879aaab4fa8f61.js Show response
static.visajourney.com/images/uploads/javascript_core/ 26 KB
6 KB 13ms
13ms Script
application/javascript 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://static.visajourney.com/images/uploads/javascript_core/front_front_core.js.1230ff5f5f8d0e9825879aaab4fa8f61.js?csrfKey=4ceb7c6d7eea78714e07db1a510ea8bb&antiCache=57b5ad54af

Requested by

Host: static.visajourney.com
URL: https://static.visajourney.com/images/uploads/javascript_global/root_library.js.2d392d822d142276d6bd08105e992c22.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (ama/4894) /

Resource Hash

e1ae210178df1b25eeca5f537d0aab1b052f012d5d33415c3be99b10b0fd2a84

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
last-modified: Thu, 25 May 2023 17:06:14 GMT
server: ECAcc (ama/4894)
age: 504380
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
cache-control: max-age=1814400
content-length: 6348
expires: Wed, 21 Jun 2023 13:28:47 GMT

GET
H2 200 rtbsspub
xch.media.net/AdExchange/ 14 KB
2 KB 20ms
19ms EventSource
text/event-stream 34.107.136.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xch.media.net/AdExchange/rtbsspub?&prvReqId=21247495814899501685539727511&gdpr=1&gdprconsent=0&cid=8CU2CYR88&itype=HB&ptrid=8PRW23HG5&sd=1&requestString=423225048*55%7C320x50%7C537100188%7C540916824%7C%7C%7C1%40423225048*141%7C1x1_T31K017_1%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C3%40423225048*175%7C320x50%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C1%40423225048*203%7C320x50%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C1%40423225048*214%7C320x50%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C1%40423225048*222%7C320x50%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C1%40423225048*233%7C320x50%7C19396%7C353028_1877750_43%7C%7C%7C1%40423225048*236%7C320x50%7C159463%7C3263727_770504%7C%7C%7C1%40423225048*237%7C320x50%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C1%40423225048*251%7C320x50%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C1%40423225048*2022%7C320x50%7C537100188%7C540552573%7C%7C%7C1%40423225048*3007%7C1x1_T31K017_1%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C3%40423225048*3017%7C1x1_T31K017_1%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C3&bl=1&hlt=1&ndec=1&region=nv&rt=5&tr=0.6211761463827317&tscode=1&crid=423225048&adt=desktop&scrsize=1600x1200&ugd=4&dn=https%3A%2F%2Fwww.visajourney.com&https=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&pageinfo=%7B%22ph%22%3A1200%2C%22vh%22%3A1200%2C%22vw%22%3A1600%7D&act=headerBid&cc=DE&ct=FRANKFURT&rc=HE&usp_enf=1&usp_status=0&rtusuid=%7B%7D&ssa=1&prid=8PRVCXX19&coppa=0&isRefresh=0&taginfo=%7B%22423225048%22%3A%7B%22supply_tag_id%22%3A%22div-gpt-ad-1573269821392-0%22%2C%22xps%22%3A201%2C%22yps%22%3A593%7D%7D&encryptionVersion=0.0

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.136.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

8b54dfb89177acd50f0f86e6ab543bd3d475930cfafdabe1efaf15199b546266

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:46 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 rtbsspub
xch.media.net/AdExchange/ 4 KB
1 KB 18ms
17ms EventSource
text/event-stream 34.107.136.65
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://xch.media.net/AdExchange/rtbsspub?&prvReqId=97799949960291521685539727514&gdpr=1&gdprconsent=0&cid=8CU2CYR88&itype=HB&ptrid=8PRW23HG5&sd=1&requestString=423225048*97%7C320x50%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C1%40423225048*108%7C1x1_T31K017_1%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C3%40423225048*3012%7C1x1_T31K017_1%7C8CU2CYR88%7C423225048_8CU2CYR88%7C%7C%7C3&bl=1&hlt=1&ndec=1&region=nv&rt=5&tr=0.32390489630736563&tscode=1&crid=423225048&adt=desktop&scrsize=1600x1200&ugd=4&dn=https%3A%2F%2Fwww.visajourney.com&https=1&requrl=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&pageinfo=%7B%22ph%22%3A1200%2C%22vh%22%3A1200%2C%22vw%22%3A1600%7D&act=headerBid&cc=DE&ct=FRANKFURT&rc=HE&usp_enf=1&usp_status=0&rtusuid=%7B%7D&ssa=1&prid=8PRVCXX19&coppa=0&isRefresh=0&taginfo=%7B%22423225048%22%3A%7B%22supply_tag_id%22%3A%22div-gpt-ad-1573269821392-0%22%2C%22xps%22%3A201%2C%22yps%22%3A593%7D%7D&encryptionVersion=0.0

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.136.65 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

Resource Hash

b4b82fc0ba5ee2c096f35b0a35a4aa99b8874ec76700788b96bc2b5b7c19b76f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: text/event-stream
Cache-Control: no-cache
Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
via: 1.1 google
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: accept-encoding
content-type: text/event-stream;charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 20ms
19ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.visajourney.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.visajourney.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 45 KB
16 KB 493ms
493ms XHR
text/plain 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4406493206897173&correlator=3501810315562222&eid=31074776%2C31074924%2C31074989%2C31074992&output=ldjh&gdfp_req=1&vrg=202305250101&ptt=17&impl=fifs&iu_parts=22806162%2CProfile-Page-About-Box%2CProfile-Mobile-Top&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=300x250%2C320x100%7C320x50&ifi=3&adks=1528070754%2C2974337371&sfv=1-0-40&prev_scp=amznbid%3D2%26amznp%3D2%26mnetPageID%3D5%26mnetCC%3DDE%26mnetCV%3D1%26mnetUGD%3D4%26mnetCID%3D8CU2CYR88%26hb_abt%3Dhb%26mnetDNB%3D1%7Camznbid%3D2%26amznp%3D2%26mnetPageID%3D15%26mnetCC%3DDE%26mnetCV%3D1%26mnetUGD%3D4%26mnetCID%3D8CU2CYR88%26hb_abt%3Dhb%26mnetDNB%3D1&eri=1&sc=1&cookie=ID%3Db06cb7c2b60dea6a-22bf9b2dfedd00e4%3AT%3D1685539727%3ART%3D1685539727%3AS%3DALNI_MZRyGXL4GhsAo1sI5tDy2Esz483Pg&gpic=UID%3D00000c2a8d645f0f%3AT%3D1685539727%3ART%3D1685539727%3AS%3DALNI_MYdaQzC5k0ov26JxF8u0uIwFB7PVA&abxe=1&dt=1685539727593&lmt=1685539714&dlt=1685539726292&idt=1194&adxs=51%2C41&adys=877%2C543&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0&ucis=1%7C2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&frm=20&vis=1&psz=330x255%7C330x100&msz=300x-1%7C320x-1&fws=0%2C0&ohw=0%2C0&ga_vid=1806750341.1685539727&ga_sid=1685539727&ga_hid=546175410&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2b634685f0a34afe99fed2a3617dc299319f81dab1a6ccb99341a475477a880

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16672
x-xss-protection: 0
google-lineitem-id: -1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.visajourney.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6F2C 6 KB
3 KB 64ms
15ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:47 GMT
expires: Thu, 30 May 2024 13:28:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 / Show response
www.facebook.com/tr/ Frame E11D 0
52 B 18ms
17ms Document
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.visajourney.com
Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.visajourney.com
alt-svc: h3=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:47 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 container.html Show response
0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4651 6 KB
3 KB 7ms
7ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:47 GMT
expires: Thu, 30 May 2024 13:28:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 15E3 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305250101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:47 GMT
expires: Thu, 30 May 2024 13:28:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 68EF 624 B
242 B 49ms
47ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLqlkwEQsZGUARiyzoPeATAB&v=APEucNWuz9orRNdp5jcLLBqKBgBNVYzPNrWG1ATx6dXl1XbM4jMFwNUsprajPV0J_CTqJz84hRK71l8Q3BcSOr9xnzSe9gIv9WPjednqyg-1je6LbSYQHEB1Qo6WgD6WaYsgqBnS0nicmVaa18_TA2Cv2QCWVUv6Wydxc-7FRSfVBr9FRnNSvbM

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4651 78 KB
27 KB 146ms
145ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4651 42 B
63 B 43ms
42ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A1RPvuUgU1msexXpNNog4ITsWqNUaO7xv52CpT8tsQ4MKPbm6KSN38he4L1kLhfjxvo7NPiJ3upZo3qqrREzWlJus0EnkZQu6__K8NR6tVfCjgNPA

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4651 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=16000164824485085235&x=1&ct=76

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 4651 3 KB
1 KB 33ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/window_focus_fy2021.js

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 11:03:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 4651 19 KB
8 KB 30ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d47e9b04cf995a35fac50d2d39cd0006ef7e7f07f9373cad2fe5a207745f1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:01:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66467
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7987
x-xss-protection: 0
server: cafe
etag: 5788035530912182302
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:01:01 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4651 171 KB
54 KB 48ms
25ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c3e04a3f536b4a6300aeee8ee1dbbfddaacaf29d9f44dadff76b136fab44e38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54244
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1684927996807358"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4938 624 B
242 B 48ms
45ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYweD4xgEwAQ&v=APEucNURdBCaSZT8Q5pmy_LSonmOxUw7j5Jqbse47z2oX06bGka0RgvJr5LJoCaCjyfTVN21q8G-no7XmoEVVtMW-nX4_Sq_2IfVM-52BEokGh2KMhgQuZ9qaWcTbEO8yMsG1U9pLIqMJQKjqligKVE2MBlQ2ZZbPaZgSClgNMHAdWkFvvoOy4w

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 15E3 78 KB
27 KB 221ms
220ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 15E3 42 B
63 B 42ms
40ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cynh0b-56R_0zj3ePRqkatSELA5nGbC8r0B9DAvCRY3SFpZIEX8j8N6JL6OS0ABh5Y1Uv_eAQhJaOMz5imQ-19I89Wxx9WnqEq2iDTHjX0eCFOfCc

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 15E3 0
20 B 43ms
41ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=3281435173975183128&x=1&ct=76

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 15E3 3 KB
1 KB 30ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/window_focus_fy2021.js

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 11:03:05 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 15E3 19 KB
8 KB 27ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d47e9b04cf995a35fac50d2d39cd0006ef7e7f07f9373cad2fe5a207745f1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:01:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66467
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7987
x-xss-protection: 0
server: cafe
etag: 5788035530912182302
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:01:01 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 15E3 0
0 18ms
16ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSjDy6n2aPiuQaHPpUKjj3HjG7GiGGunwD9COPB3MU0DKI-ltDjGLGOlzWfPeRra-pko8Cb6u13oXh18Zc8Jdb2Ny_yvA
Requested by: Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 15E3 171 KB
53 KB 67ms
48ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c3e04a3f536b4a6300aeee8ee1dbbfddaacaf29d9f44dadff76b136fab44e38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54244
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1684927996807358"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 68EF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1

43 B
766 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLqlkwEQsZGUARiyzoPeATAB&v=APEucNWuz9orRNdp5jcLLBqKBgBNVYzPNrWG1ATx6dXl1XbM4jMFwNUsprajPV0J_CTqJz84hRK71l8Q3BcSOr9xnzSe9gIv9WPjednqyg-1je6LbSYQHEB1Qo6WgD6WaYsgqBnS0nicmVaa18_TA2Cv2QCWVUv6Wydxc-7FRSfVBr9FRnNSvbM
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 68EF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZHdLkN5vuIAGCgRPcnnGsgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1

43 B
632 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLqlkwEQsZGUARiyzoPeATAB&v=APEucNWuz9orRNdp5jcLLBqKBgBNVYzPNrWG1ATx6dXl1XbM4jMFwNUsprajPV0J_CTqJz84hRK71l8Q3BcSOr9xnzSe9gIv9WPjednqyg-1je6LbSYQHEB1Qo6WgD6WaYsgqBnS0nicmVaa18_TA2Cv2QCWVUv6Wydxc-7FRSfVBr9FRnNSvbM
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 68EF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEK8XEH-r6X091EH6iaB65Ek&google_cver=1

43 B
1 KB

15ms
6ms

Image
image/gif

37.252.171.85
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEK8XEH-r6X091EH6iaB65Ek&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLqlkwEQsZGUARiyzoPeATAB&v=APEucNWuz9orRNdp5jcLLBqKBgBNVYzPNrWG1ATx6dXl1XbM4jMFwNUsprajPV0J_CTqJz84hRK71l8Q3BcSOr9xnzSe9gIv9WPjednqyg-1je6LbSYQHEB1Qo6WgD6WaYsgqBnS0nicmVaa18_TA2Cv2QCWVUv6Wydxc-7FRSfVBr9FRnNSvbM

Protocol

HTTP/1.1

Server

37.252.171.85 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:48 GMT
AN-X-Request-Uuid: dc4bf997-c041-4128-9df1-89903c4f480d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 217.64.151.68; 217.64.151.68; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEK8XEH-r6X091EH6iaB65Ek&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 68EF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU0NzM4MjkwNDEyMjY4Nzg1NQ%3D%3D

170 B
243 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU0NzM4MjkwNDEyMjY4Nzg1NQ%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 31 May 2023 13:28:48 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.68; 217.64.151.68; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2613f793-cb1b-43be-a331-894186515384
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU0NzM4MjkwNDEyMjY4Nzg1NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYweD4xgEwAQ&v=APEucNURdBCaSZT8Q5pmy_LSonmOxUw7j5Jqbse47z2oX06bGka0RgvJr5LJoCaCjyfTVN21q8G-no7XmoEVVtMW-nX4_Sq_2IfVM-52BEokGh2KMhgQuZ9qaWcTbEO8yMsG1U9pLIqMJQKjqligKVE2MBlQ2ZZbPaZgSClgNMHAdWkFvvoOy4w
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4938
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZHdLkN5vuIAGCgRPcnnGsgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1

43 B
766 B

8ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYweD4xgEwAQ&v=APEucNURdBCaSZT8Q5pmy_LSonmOxUw7j5Jqbse47z2oX06bGka0RgvJr5LJoCaCjyfTVN21q8G-no7XmoEVVtMW-nX4_Sq_2IfVM-52BEokGh2KMhgQuZ9qaWcTbEO8yMsG1U9pLIqMJQKjqligKVE2MBlQ2ZZbPaZgSClgNMHAdWkFvvoOy4w
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEOoOR_xkqt7jIOOYQGVCni4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4938
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEK8XEH-r6X091EH6iaB65Ek&google_cver=1

43 B
1 KB

17ms
8ms

Image
image/gif

37.252.171.85
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEK8XEH-r6X091EH6iaB65Ek&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYweD4xgEwAQ&v=APEucNURdBCaSZT8Q5pmy_LSonmOxUw7j5Jqbse47z2oX06bGka0RgvJr5LJoCaCjyfTVN21q8G-no7XmoEVVtMW-nX4_Sq_2IfVM-52BEokGh2KMhgQuZ9qaWcTbEO8yMsG1U9pLIqMJQKjqligKVE2MBlQ2ZZbPaZgSClgNMHAdWkFvvoOy4w

Protocol

HTTP/1.1

Server

37.252.171.85 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:48 GMT
AN-X-Request-Uuid: ee752a75-843f-4e24-b575-f2ecbe04ee67
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 217.64.151.68; 217.64.151.68; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEK8XEH-r6X091EH6iaB65Ek&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4938
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU0NzM4MjkwNDEyMjY4Nzg1NQ%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU0NzM4MjkwNDEyMjY4Nzg1NQ%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 31 May 2023 13:28:48 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.68; 217.64.151.68; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 5c35e9a1-2ed3-4564-a2de-68b962d7bb1f
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU0NzM4MjkwNDEyMjY4Nzg1NQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305250101/ 152 KB
52 KB 59ms
58ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305250101/reactive_library_fy2021.js?bust=31074966

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66e3cef055a6103702e5e41b7954e4d41b4ab6206ee0f2d02432cf0e7501cf34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52764
x-xss-protection: 0
server: cafe
etag: 3185564212799930358
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 24ms
24ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=1&rn=0.7205758959598412

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-5qui_H97SsMnH9uJvNriSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport, script-src 'report-sample' 'nonce-5qui_H97SsMnH9uJvNriSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 px.gif
fundingchoicesmessages.google.com/img/ 43 B
68 B 27ms
27ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fundingchoicesmessages.google.com/img/px.gif?ch=2&rn=2.9611271746933023

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3P-tDOL3KBvc3QU9ByD1rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-security-policy: script-src 'report-sample' 'nonce-3P-tDOL3KBvc3QU9ByD1rA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingDetectionHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingDetectionHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingDetectionHttp/cspreport
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: image/gif
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4651 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8624099347154&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4651 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8624099347154&version=m202301230201&ct=76&x=1&cor=16000164824485085000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4651 73 KB
34 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dak4njbfFSJzRyuyR8HOZ-P3JJsoEj4ZR3m4Icb8BsuRwNPhDS2rLeFYALoKT7jqHFSZqEOrOfyQFTSmY5rwlSybs4vw&cry=1&dbm_d=AKAmf-AkGsR-d5rlqqA2bM6ZIQm6NskUQVoenaRuR0v1tH8x9Nczeq1lJU9eo8jff7fsCG7wUVu4MuDPz-7iosYwkUvQpPXcPD8XguUK5aml2Ps5xlEI90y6TNPqcl8XorR3trM55F-ZYBzD-2pNlz7W794ba1a-nVyIuLKrQIfTQyPpNasvp-cxZ1-VZrlATK2OsNykdyOOKH35t1n5OCuchBlUeLGqeJqWtKVgzwEAyyqTlk00hlH_N4bP_SY6inKl4D-7P7GUPv2Mdpg8RULta00Nj4Rvt9NZwFWqB9Uj54lU3tpl2j4e4iQOz2dJ6rswu3hZ8246XEUs9Q59CPgIHcP2_OulEljFgSrpCtxm5IpDJjjWV7fY7-zrmDSoOHw3BzFc_CbL0qKv3stSrK4Za1sOeUiH9bLpeMZo6TNGweDNEmf0a2Rg9lUtDZB-eu0cotoK1ORJXLFO4GeQeVGWr0f-AMVUSpbn4Hg0V1O6oXQ8lmmlVuWFR00o2PDmBX0Jhe8rwSm1odCM_hHk6OW7mCLGQqpcAhsP6XGMP7VfOk02HkM0CDxC1psgIlxiHLUXYGvJf_LOPpnDon7Dnb-hIkmK2iiZcGAcG2bVA0BhXU5e0rD9iStFQkYKN8su5--eTMmZWcKUaVHxILJzajD5T0YZyqK__GLXM4TnekzWOTm_46wGFHb7quw7s3oM_hLd8Rya1AbOuIN-D1NhWg8JUvZNph9XtZxywxdmMVn94nAIASrDAUeksjEEezS0SJ_rgP6GkpTUcMustDTic9Qyx4AbFhg8_ajyGjIZZaVoJI-4MPSKX5bA0HrQlDr4m6hlWjAFK9YGIxTeslqRkmyr9RKI0U-oucvOApgadwgfUMbSgmZn170Xs_fyVXllCNNsorH-s9uUqZwdm79WnD832DE1MiRxqwFWXBfQYcAvk6eHNYSkNFJ9qhkKQx6MJxSTT4tXZbJIZhxMeLSxoLMcUG7GnCDxCAbQBPaDqIVs78o329QWm1_81WWpxs1NfhCbEokAQW1Vi2A-V6rHpWsuCK6k4TYf7lF6aNW2J93BCSEkMDSOmRifrmX2bycBk9vsJGcDN_q_2eaSMDve8dODVfY25P7F3xutUGg0eMRVD_8ChLkcPwi844vyjPKBOcPMl6gdTUXfPTeFWwPOznPy04LEBSWyWdMN3mixyahT2dTue3VeUsctZTHfwlTf5i6yrywsVGWaAVXtd-OkI4IhJGO7ENncMavNdYP7p5bF6Wc3fAj-rRsZcjCh3idDRrMcUkfMSNysYcmzrdu1I2-qGwZaYntMR9hICFum8Yj728k7aDvigGDUCeA4n6sA5WF5zNfI9uibW0qWOdd5oEmveHl1PEoQLrcFbZb1IuxGrbAssnlzqnh0fy2-xa11LWe-EyndGjAOM89DYW8LoBSlkVArxW59vFvdNLz3HXp3A60YId0mMuYcySZ3GxIoksK09sOst5YxKkcf1KkATPvslvWxLDk4Eusj8yQFdBtMwMJiVjlHglyHA16tjBEj8TYQA3t_FrUMYMC2g0RCoM4GF-WQSWUxhmeKm42UDTdeoORrZTbFjVvaVThEcBZN81icfqdoC0PUICcbXEvexQeXida-uzVXAXxpjieU7eM7xGg0HEIseBK1b4PuhECuy-lFouJy9r3vcn2h92cuVKrk_yVdQv_glJfQG5xaixNWGan5_ynJqCwqxwOsFkcPyouI9i-5A419mTISbvR8SFSXvh5yYs7F2T0U7j5CS9agRyNATqPig9972YjwENVCeT2I6g_4WPt0FvnAGahilxVd10BNdGyx-TQVlp1ADR4pc9XQms3jRpoOLvStfxowQH4rXqgoTVGFXv81tdyoeMEY9zzhCNXNLFbRA3GNUPUUmWtcjDEK1VnwPcvYY5Htjz76pXeb74ukhBnd3loB_GITlgK4tw62ITBynpdZXDNTo4WNzBmfc20pqWW8YqWcaEA00_UZHoIEXhNa3tXEO1UCpHUA3Z-n3RRGYHCb8oK3uJ_kwq9TTZm8rm1nX6qVEl7Z6UDV3YrY31joKP8JBW5oDUk0VojUlguiU06T4kGZeCmUW6B5jQ06LRi6nhj-D8CzwqjM_ed1Oc0NFWB-cTH0ieltcR6-6IJIarnd2MBHVUfSJJtYy-jKCJOGZwIl_HF__-2Es-AQQvoCnkRRXXdsWN4EebICcCAmfjwUfAQrWrp0mO22_gIBTUagwJYsplSJawp1a7KoSnQXnGI33D-dZwT8r7poZ5qZV5SF9or-21UyHiyYIXHslwVD_v3Mf4QlunLHjN1MQ4TP6fiIQpfhjw9Tar2Cb9CtPdrxPyMkUO8hSgbKZvJL-j8IFBEbt1u2jRr1alK9JylP0aLVRmBUocaSF9VjWR-0ktgiRbHMB8Efhcu9lleJ7MvE2Q-gdhvYiC-_gQ2byq0QbP1CdYsvQh_ymUZqsHq5F7WPCZ1w9IRC8ZdNMszSS_4c6ZfkmPh7y3HJ3T4mwTeAWeU0S5VxgEw-9ya5zmOFyXZs7cZjSApF5HmjAC57mmnDJiGM69lL4qSOGoBHKsILXhLwYMefJ6hRae2AjmCyEsdGsLcDmoTp9ayNrzlc0-u0n1fo4996NXavLjyN1qTo8vy7pIl4R6LXM3gRUBPhSVj8-1YDpZY531SEG62uqpeAyMup8NOQ6GRDw2P5cTbs35uYNfse8LDrl5DOVmvZOO0eg3Xy3szFBm5SZkH_hM_Cz31dvjN4vjOmbig-tAXvYhg2pnpRIidK-OnGfu3DSY9XDahH8UXHQ6wOSSZCTfmPHbS_89i6IRcTsQDhqlbPPFesQ2FD343UHMUi66wbKiQqD77kg1ifFCvrQxM02uSSgWAkLZTfKLLWVnVideoqTSYz391X_Fxcg17GaZLjv4qtPIu_69YlTxCkHUQgT5R6OXjFfpvta6MW7d80IBVjx3NBDXi8pSBmSilA7ivZZHHIUmnXfh4rmZJ-0dfluYrRjfM_FMQ_mH3SkrxhQ7WxLVhLRoD0fAKA50u9MU9I5Nvk-pYOZfAPV6jC8FpQ107YSRmxfX4aRy4_lbbUmNBTo5zF4E7QaryGhx2_5ZhxRjIVOfD1JKrXSoZGGkRC8Su6bDxIVAq2cs0O0zAH61Xn9izD53m38ogcT_TCjX9hM2sGLwdfo_7Tl52Ge2BDeSWvDmNi2RzmrORnqSFa3Fl9GNklbzMupUz9JpK43ZrJ9JhnSTBPv4C-4amTMEPND41ovZs54KFRvVlcd1v_SZbJ3ophXV6IhV2M494QspVd-ofWAHhwTtjXtxQ9S1-0sP0neWfrkvLo-JCt3ZrhzdW4iuwVRKrwpXEUdMrokGmdvGi4Wu7GJRtmsCGdOL67ja_7_OxKJ1XqCkmuoH47mj7QdsjWuklPZ9YargepqrahxW3dySz1rcikUs6NZ1BnHKWbiouEMrVOKXkL3_9yPd5q-WskD9Qu86ewd_xfdM_a_4yC4fz3asrFuhYGX_iWzEDlM3QIgP6EPjid1RdG&cid=CAQSPABygQiDK6JitLTFtWaNhpqNVhIeVfjRDT00EFSnMS6bRkgcdouPTZndccBTZAx-mrN4PEM23K74utEulRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.visajourney.com%2F&ds=l&xdt=1&iif=1&cor=16000164824485085000&adk=2857193498&idt=151&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b31665a0ba8e5343bd1cd058b72e9d02a42e752b2aaf4200f7b094fc686442b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34814
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.visajourney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.visajourney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/ Frame AF1F 10 KB
4 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48285
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 00:04:03 GMT
etag: 15057649708203361565
expires: Wed, 14 Jun 2023 00:04:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/ Frame CCC4 10 KB
4 KB 7ms
6ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48285
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4540
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 00:04:03 GMT
etag: 15057649708203361565
expires: Wed, 14 Jun 2023 00:04:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 36ms
22ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HIeJ3ucOtMEQG8F1HkFvVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-security-policy: script-src 'report-sample' 'nonce-HIeJ3ucOtMEQG8F1HkFvVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.visajourney.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame AF1F 4 KB
767 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:05:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame AF1F 205 B
648 B 33ms
8ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:27:03 GMT
x-content-type-options: nosniff
age: 105
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 30 May 2024 13:27:03 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame AF1F 604 B
694 B 33ms
8ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:22:16 GMT
x-content-type-options: nosniff
age: 7592
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 30 May 2024 11:22:16 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/ Frame AF1F 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdb8889029e112e6178e400c7b7b4b900ca01e12f08089e994a055236b4b74d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 23:59:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5756
x-xss-protection: 0
server: cafe
etag: 6942144704403180717
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 23:59:34 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/ Frame AF1F 20 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

410f4228aa677eb20622c6f1e0f67966fcecca198ad07bb096f0265b2689ded7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:47:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 63683
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8300
x-xss-protection: 0
server: cafe
etag: 2697337515266134059
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:47:25 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame CCC4 0
0 50ms
49ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CFt0dj0t3ZJ-GIr-R5LcPkb-G8AzJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zNDA3NTA4NDY3Nzg4MjYzyAEJqQIIZ8AONumxPqgDAaoE5AFP0Ar-Qv3eCS6hhi2XxRSCmwYlGoGfs7keoNMFl4BMGmLJB2dQWp5K8ZgBkcWYtC5hRqttq22mceYIZX4INs3MYpsDgx0Mt5ITQ4dhhx8wiLPvwEFtWpAo2i57pou1XjEDdg9x2fv2-ODLBxKV_XHJIOOqCZ23ULAhaGBhozM2-ukwV3CSKXwm84ZJrrTLbUWKQvcplMtyt3T--eN6c_kHKwssFxs7rVBuwRzuWvHl7y4cldD1iQVflJFbHtMq_2dwFIU4QjOmpfQsGgXiEEHSw6hQ4PWQtlJkJhld8hFsBnY469yABpL3rPf7vsa7K6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgECACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMzQwNzUwODQ2Nzc4ODI2MxgA&sigh=CvhlyOl00hA&uach_m=[UACH]&cid=CAQSKQBygQiDE82MVJZ_YiFI2cvuGzfUeaclX7_vKR0eJWnfX7CwCP4PBjWFGAE

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame CCC4 0
0 42ms
12ms Fetch 2a02:2638:3::9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=kPDhCcz6RO0HfJ2DYgICAAAAJV6KOHBr-HAQj0t3ZP5CvB9Hb01d29oAABIAAAoKQVFVQkFRRUJBUQ&wp=ZHdLjwAIgx8A-Qi_AAGfkXmC2rcmobY4qPsI4A

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 130053
server: Kestrel
content-length: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 2367 124 KB
44 KB 93ms
65ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=ZHdLjwAIgx8A-Qi_AAGfkXmC2rcmobY4qPsI4A&u=%7CBnQ%2BM9Fep1zpd%2BGfcgF4vWkwdspSzDfjuKZt6UyFJXw%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jhV7Kd6SKvkZ2c775jfyZY6fGSNGGFpANeU-bVyDuEyqZdUG7FfVguKjFFL_1-YhDmZMS8XTB7NdjNMEVyBMpwezplG5cZP4NIGRCeO4qDi09YpOVJVXvmCP1xmqCS-vVZfPY8MAKKfugLVWUR9qPSYFTGwaNa3ziEVuMtbIAPrOC0zcAFDRApDAkzxulf6EP8AvHplk3BiQjVyj6WLi3bBaKLYhyIP4ddwfipGdD-7oMIVOrQnImHzepC0I0O_dTZbPuM1bIqvwf-DmilmJwDFkArRR-1INWiVbyI_1JEifnvsBzOqEkjHSOvWxhCWaJoRkKRnYaKYqhYJRje7AUrpawuUtu_w_bXK78fNttvBQzpH9bEn1zOdUkbh5RzPkTLWFkTXsP3QrYEs9iceZ5USOnSZa7lomDHUwc-6PP5HGdq7HvWEBbPhkEh9w4-DHAO82eTDyCGu3DJ1Sm1dM3LOvdJ7jDjMXo5xATtWPNFWDZ-GB088-_EDZSYLq2DgMal4Z7u9f18shvFrOtd1Piu5Gfwq9y7U1rQ8lBcxrW2ZXoececn07Ngq4OrroqRr1LjJInV0U14gv&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDtwuj0t3ZJ-GIr-R5LcPkb-G8AzJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zNDA3NTA4NDY3Nzg4MjYzyAEJqQIIZ8AONumxPqgDAaoE5wFP0Ar-Qv3eCS6hhi2XxRSCmwYlGoGfs7keoNMFl4BMGmLJB2dQWp5K8ZgBkcWYtC5hRqttq22mceYIZX4INs3MYpsDgx0Mt5ITQ4dhhx8wiLPvwEFtWpAo2i57pou1XjEDdg9x2fv2-ODLBxKV_XHJIOOqCZ23ULAhaGBhozM2-ukwV3CSKXwm84ZJrrTLbUWKQvcplMtyt3T--eN6c_kHKwssFxs7rVBuwRzuWvHl7y4cldD1iQVflJFbHtMqvWVRhgK33iAZOeCPyjhE6EjGyR5azu0SAppZgOvi7D10g9y8-GPVh3KABpL3rPf7vsa7K6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0n91DsVexn7CjkHXiNd8foJW-B0A%26client%3Dca-pub-3407508467788263%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

df9299ced52fd52af48bce922b2e730bfef0d7ff5260088b7d9c730673bbb737

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=xD2X-_eIMyqkT6ne6bxSTdhZBJxfxeKOjW00Hg5fvUOWVeLIkSsogAEdiyUuuUVe_8aBaRLm9WEnJ6ZqDNnH5Tc0TovXeFVndWrEycIZzGHfIBUGaBOt7ayz8YnOveQzMPFpsmVqHL8MIibR4xlcxNtI2pv2WyLrNZW6bN249zRxDzPJazSHfj2n0Rjub-scIbrsBiNC7IlSKISdm3wXOMxUgtGIa0IO8QFI7UOY6oz2Zya31YGPqJS_YdvXspuQLBUaJw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 51469246
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame CCC4 3 KB
1 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 11:03:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D228 1 KB
643 B 9ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 10512
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 10:33:36 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 10:33:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame CCC4 19 KB
8 KB 11ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d47e9b04cf995a35fac50d2d39cd0006ef7e7f07f9373cad2fe5a207745f1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:01:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66467
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7987
x-xss-protection: 0
server: cafe
etag: 5788035530912182302
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:01:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame CCC4 0
0 17ms
14ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTKlUAol2FEhtNlqnhW6yIAkFbPdPv7IjS4avONpBfs9NqBg4_EgGI-rIlYsr9I1QPMLz40ixRWpp3InUnSutyPEQzBtA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CCC4 171 KB
53 KB 21ms
17ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c3e04a3f536b4a6300aeee8ee1dbbfddaacaf29d9f44dadff76b136fab44e38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54244
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1684927996807358"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/ Frame 4651 29 KB
11 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Dak4njbfFSJzRyuyR8HOZ-P3JJsoEj4ZR3m4Icb8BsuRwNPhDS2rLeFYALoKT7jqHFSZqEOrOfyQFTSmY5rwlSybs4vw&cry=1&dbm_d=AKAmf-AkGsR-d5rlqqA2bM6ZIQm6NskUQVoenaRuR0v1tH8x9Nczeq1lJU9eo8jff7fsCG7wUVu4MuDPz-7iosYwkUvQpPXcPD8XguUK5aml2Ps5xlEI90y6TNPqcl8XorR3trM55F-ZYBzD-2pNlz7W794ba1a-nVyIuLKrQIfTQyPpNasvp-cxZ1-VZrlATK2OsNykdyOOKH35t1n5OCuchBlUeLGqeJqWtKVgzwEAyyqTlk00hlH_N4bP_SY6inKl4D-7P7GUPv2Mdpg8RULta00Nj4Rvt9NZwFWqB9Uj54lU3tpl2j4e4iQOz2dJ6rswu3hZ8246XEUs9Q59CPgIHcP2_OulEljFgSrpCtxm5IpDJjjWV7fY7-zrmDSoOHw3BzFc_CbL0qKv3stSrK4Za1sOeUiH9bLpeMZo6TNGweDNEmf0a2Rg9lUtDZB-eu0cotoK1ORJXLFO4GeQeVGWr0f-AMVUSpbn4Hg0V1O6oXQ8lmmlVuWFR00o2PDmBX0Jhe8rwSm1odCM_hHk6OW7mCLGQqpcAhsP6XGMP7VfOk02HkM0CDxC1psgIlxiHLUXYGvJf_LOPpnDon7Dnb-hIkmK2iiZcGAcG2bVA0BhXU5e0rD9iStFQkYKN8su5--eTMmZWcKUaVHxILJzajD5T0YZyqK__GLXM4TnekzWOTm_46wGFHb7quw7s3oM_hLd8Rya1AbOuIN-D1NhWg8JUvZNph9XtZxywxdmMVn94nAIASrDAUeksjEEezS0SJ_rgP6GkpTUcMustDTic9Qyx4AbFhg8_ajyGjIZZaVoJI-4MPSKX5bA0HrQlDr4m6hlWjAFK9YGIxTeslqRkmyr9RKI0U-oucvOApgadwgfUMbSgmZn170Xs_fyVXllCNNsorH-s9uUqZwdm79WnD832DE1MiRxqwFWXBfQYcAvk6eHNYSkNFJ9qhkKQx6MJxSTT4tXZbJIZhxMeLSxoLMcUG7GnCDxCAbQBPaDqIVs78o329QWm1_81WWpxs1NfhCbEokAQW1Vi2A-V6rHpWsuCK6k4TYf7lF6aNW2J93BCSEkMDSOmRifrmX2bycBk9vsJGcDN_q_2eaSMDve8dODVfY25P7F3xutUGg0eMRVD_8ChLkcPwi844vyjPKBOcPMl6gdTUXfPTeFWwPOznPy04LEBSWyWdMN3mixyahT2dTue3VeUsctZTHfwlTf5i6yrywsVGWaAVXtd-OkI4IhJGO7ENncMavNdYP7p5bF6Wc3fAj-rRsZcjCh3idDRrMcUkfMSNysYcmzrdu1I2-qGwZaYntMR9hICFum8Yj728k7aDvigGDUCeA4n6sA5WF5zNfI9uibW0qWOdd5oEmveHl1PEoQLrcFbZb1IuxGrbAssnlzqnh0fy2-xa11LWe-EyndGjAOM89DYW8LoBSlkVArxW59vFvdNLz3HXp3A60YId0mMuYcySZ3GxIoksK09sOst5YxKkcf1KkATPvslvWxLDk4Eusj8yQFdBtMwMJiVjlHglyHA16tjBEj8TYQA3t_FrUMYMC2g0RCoM4GF-WQSWUxhmeKm42UDTdeoORrZTbFjVvaVThEcBZN81icfqdoC0PUICcbXEvexQeXida-uzVXAXxpjieU7eM7xGg0HEIseBK1b4PuhECuy-lFouJy9r3vcn2h92cuVKrk_yVdQv_glJfQG5xaixNWGan5_ynJqCwqxwOsFkcPyouI9i-5A419mTISbvR8SFSXvh5yYs7F2T0U7j5CS9agRyNATqPig9972YjwENVCeT2I6g_4WPt0FvnAGahilxVd10BNdGyx-TQVlp1ADR4pc9XQms3jRpoOLvStfxowQH4rXqgoTVGFXv81tdyoeMEY9zzhCNXNLFbRA3GNUPUUmWtcjDEK1VnwPcvYY5Htjz76pXeb74ukhBnd3loB_GITlgK4tw62ITBynpdZXDNTo4WNzBmfc20pqWW8YqWcaEA00_UZHoIEXhNa3tXEO1UCpHUA3Z-n3RRGYHCb8oK3uJ_kwq9TTZm8rm1nX6qVEl7Z6UDV3YrY31joKP8JBW5oDUk0VojUlguiU06T4kGZeCmUW6B5jQ06LRi6nhj-D8CzwqjM_ed1Oc0NFWB-cTH0ieltcR6-6IJIarnd2MBHVUfSJJtYy-jKCJOGZwIl_HF__-2Es-AQQvoCnkRRXXdsWN4EebICcCAmfjwUfAQrWrp0mO22_gIBTUagwJYsplSJawp1a7KoSnQXnGI33D-dZwT8r7poZ5qZV5SF9or-21UyHiyYIXHslwVD_v3Mf4QlunLHjN1MQ4TP6fiIQpfhjw9Tar2Cb9CtPdrxPyMkUO8hSgbKZvJL-j8IFBEbt1u2jRr1alK9JylP0aLVRmBUocaSF9VjWR-0ktgiRbHMB8Efhcu9lleJ7MvE2Q-gdhvYiC-_gQ2byq0QbP1CdYsvQh_ymUZqsHq5F7WPCZ1w9IRC8ZdNMszSS_4c6ZfkmPh7y3HJ3T4mwTeAWeU0S5VxgEw-9ya5zmOFyXZs7cZjSApF5HmjAC57mmnDJiGM69lL4qSOGoBHKsILXhLwYMefJ6hRae2AjmCyEsdGsLcDmoTp9ayNrzlc0-u0n1fo4996NXavLjyN1qTo8vy7pIl4R6LXM3gRUBPhSVj8-1YDpZY531SEG62uqpeAyMup8NOQ6GRDw2P5cTbs35uYNfse8LDrl5DOVmvZOO0eg3Xy3szFBm5SZkH_hM_Cz31dvjN4vjOmbig-tAXvYhg2pnpRIidK-OnGfu3DSY9XDahH8UXHQ6wOSSZCTfmPHbS_89i6IRcTsQDhqlbPPFesQ2FD343UHMUi66wbKiQqD77kg1ifFCvrQxM02uSSgWAkLZTfKLLWVnVideoqTSYz391X_Fxcg17GaZLjv4qtPIu_69YlTxCkHUQgT5R6OXjFfpvta6MW7d80IBVjx3NBDXi8pSBmSilA7ivZZHHIUmnXfh4rmZJ-0dfluYrRjfM_FMQ_mH3SkrxhQ7WxLVhLRoD0fAKA50u9MU9I5Nvk-pYOZfAPV6jC8FpQ107YSRmxfX4aRy4_lbbUmNBTo5zF4E7QaryGhx2_5ZhxRjIVOfD1JKrXSoZGGkRC8Su6bDxIVAq2cs0O0zAH61Xn9izD53m38ogcT_TCjX9hM2sGLwdfo_7Tl52Ge2BDeSWvDmNi2RzmrORnqSFa3Fl9GNklbzMupUz9JpK43ZrJ9JhnSTBPv4C-4amTMEPND41ovZs54KFRvVlcd1v_SZbJ3ophXV6IhV2M494QspVd-ofWAHhwTtjXtxQ9S1-0sP0neWfrkvLo-JCt3ZrhzdW4iuwVRKrwpXEUdMrokGmdvGi4Wu7GJRtmsCGdOL67ja_7_OxKJ1XqCkmuoH47mj7QdsjWuklPZ9YargepqrahxW3dySz1rcikUs6NZ1BnHKWbiouEMrVOKXkL3_9yPd5q-WskD9Qu86ewd_xfdM_a_4yC4fz3asrFuhYGX_iWzEDlM3QIgP6EPjid1RdG&cid=CAQSPABygQiDK6JitLTFtWaNhpqNVhIeVfjRDT00EFSnMS6bRkgcdouPTZndccBTZAx-mrN4PEM23K74utEulRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.visajourney.com%2F&ds=l&xdt=1&iif=1&cor=16000164824485085000&adk=2857193498&idt=151&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:25:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65009
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:25:19 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/ Frame 4651 11 KB
4 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 18:59:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66572
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 18:59:16 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4651 0
0 81ms
51ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsums83JQj5R1pS1FC-hdx16neq_PE6I95ldR-APLtw_Dr-6wtUiqxlg8dvmk9OnWN1rmIt6hBcNhLWxuImN8yZr-dYXAyUhhihwas8sc1e5ay2PyDifR4Vtt2Ds1tUw99bBxyMEm5Ei9VeVvKZCF51lUKepdVoP9awc28WODlTrSDruK2T37uzcqrHyaF0c5Q58Ro62mg-FzKwOhQz4gOzKQBGVkFUXoiFtbRSpivAdXorrJtR77_RAEuSSvebpnRjeBTkvMKv4EKYql5Dwe_1VqJg9wR0ZOAR0TP93TBgh48A9wyXGdANFD-xSTfRxQfc_TW5d7nEXLYN9quBEsvA1L1aP1-2S3o3d-goLZ4ASyr4Tjr7A9RQlTMj7p1mlKfhY2Fo9LI9EKl-TD8wZc-wpMbrw7MRfLZL6C1i7seW1Hwls4BLyEKAgKuvUY3wph9_1nsn66UfbQF2HmtBWJc9wxOvfyhcXrv2Z37z8agzHVlN-HayU2FcMbRehFIccLDsb5nD3z7z8oCpBPaG6ZmEJum42sM81OTOATdGeqUBzq-UCXSl5ibjIeF9wTfWn95mbSvIaszEmkji70XksVgIdPgOA_5WH_3jmlAajfiEVPYga2g0hfRNG6oXlqVORPN3O7bQLS_VB8L4gDJyIL4BVX43rmcumYJMdJdhmAV8HyEZOLz_pmUecRJ3nJXDvjE_ZKqLxSX97Fa79W-Yb6R4CU7dWeiX2U1mifcLd8FI1huTEgfW9mfj6tmCteyrMZdpqWoCaHGff0C-EF2osgRntBp5RIFe9THKaR2aGuVmERLepsbB11wi8ZFEK0ywuDSmjOL-EB3P0zh85gj80JbR78Jk7nVJ2w7Gwi0cyy3a6vxbAPl-_I1ECGVH1oPRIlQ-dNtm2ffiXpKvLAnVgwEfvpjWAUfHs6g4_vrdvFKmk8xogbXWoSXrYQp8iQC4Wb9kwuteHcRRX5ybt4yRvbmouPDqVdcCodqh09IExNKXHJXzu15Az9404o6LwdFncVee7E6H_g326fLLZBIdygHYXbhaIiQ8GPiBEi0cTzp4rY5U6zhk2iBL7uyPD2PLYgDrjSyC5duy7QLbMLov2ZozVx-aTjf6CeQ9MEJJPvHdCboyTU_eqPO8lS5phuJm63pcs46qS3fihqJlNE7NR8MnRT05hnR7TRYj4gLqZ6YAkA-pyed1NmwOUnJw0MbKEkILMjBbNbXkMnbyAm2jBuZOXnVxr38EACiyz3rvsmm3YI251LYbvviw41b35d2R5cuRSEIhfhBh_h5f4QyY_3ryP09TzyDk&sai=AMfl-YRZfn_f7yvKAG74GnihVHKPjY3JsvUOLVS1-NT3ST-9q0yclGVaRhNdF8Q7n4cG_HfmzkL8fl1Jh44ZEP5_8IxnFaDSKeU3y0f_IlHwK7jFEAeN1EBuPo56s3aatfF-1m19o0o7ANxzm-jtFMFR_1Tk9VkJ10isMsQOPFJJvp6JHReYRTMSGdueJ0-o9aeppZCHjjqszDgGkKtE_KlJId9hNZgvXINY5oEzbz1ExMq0qKjZz2zOgTCfkqnWyGCjjw2Rlfkijyx1Tsd4kAj8ryGWjOokR_2I&sig=Cg0ArKJSzPidFXqxCu5gEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20230525.51728&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4651 41 KB
15 KB 12ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 107355
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H2 200 2216625943400310480
s0.2mdn.net/simgad/ Frame 4651 61 KB
62 KB 30ms
6ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/2216625943400310480

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fbbe2b6b72218c80938301609f745dffbf98b88a7aad2e8508a70187e78aa5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 28 May 2023 23:14:05 GMT
x-content-type-options: nosniff
age: 224083
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62705
x-xss-protection: 0
last-modified: Thu, 08 Dec 2022 09:41:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 27 May 2024 23:14:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D159 1 KB
643 B 10ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 10512
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 10:33:36 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 10:33:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4651 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9bf07e4af18976c095f10ae093aa44a8da132a01938e2699ce1f1cd63736eae1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 15E3 0
20 B 41ms
40ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7358323133021&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 15E3 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7358323133021&version=m202301230201&ct=76&x=1&cor=3281435173975183400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 15E3 91 KB
37 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVoTIStzOeeHK6l_VmCJ6vwRxzV0e9SyjL_Hvpvo_WkW4Fdl962IO8zI9rJ-m79NMJ8-8uusps_4aSnIR6ZyQs8T8Xcf--NtEN3DqhtTrV0ImU8qL9gJIwvqlwvEFfw3Is7_Nd2ARdI3K8kBmkx6A9mSVsSmTXPYqxpi1k08IxH0OdSKU&dbm_d=AKAmf-DSeBBQWmtwM9cfEDOdj6MRGQyDVTlkPihyrb959XqAgVaJmg9CvK-lcmRkkwv8F5TW1vlurYFm000uE40Z2dmazlfTYT16yZRzhXdlyjCp9y_2pw0sb2peQ6ZPq3CGKV5MGnTEAgee80J7eU93uUk5JvuZ_SBx2LAEr4pHxN8q8ZEitTZ3NAYFp7t-OgAMstiBOFpAb6ASYtb39A9qOtXlEoWZnkOXwRUUwfFjbClRj_BPm1RyvtwZzLnebWakAnUdLCoMWeAnVcrxL_PatLdhp4eVGAb0DVYgqVUkp14Y8lB5pjIUSIOWho3LdNAOcB6z9wz0CTz3c-aR-fa6fCVPCmJ_yVikkdFAeiQ2svGsy0SW8LCxx2EYzYFG-VOFa3YOcjt_Ftv2AG6ZY6HtvsoGWPqkoF3x3NAAUtZhU03dABcNeBUrohtMGlSUVB5ZA1Ekk-cC8V09HOCQ2f3v1DHPtSm9nXJqJsDXOmydj-TD8IrYhSm7kks3p-Ig7KaJnS2GmJp9zVFrmYPvWgRAMoCapPJytysH-lhK4rT5S7b3fn8KbtmKcuKs6c9ow1DKa4GuX4TrVZ1Blot6bS08mHuc6n-NTlaPmaoYDgw2tmSJW7y-yje_MpoKZ1fTSjyiJ9-HT2FFGOL_vpntTzgHRlEJywjOl1vSIP-MP2tJY3e7n8clcyHbWMiMbFXsvQ0tBxVyO05MQh16DroDRZ0x-HNYk_xVj55Xtq9gTiuVgYyiC_UH0PGjHdArIjKk5i4_BSQNAa8Aps0F0wLz6EqbLWobRuOpK36R0YDE8CKUuNa53oVNIhXSuRs-9AXCJSEULeXNLWSK0Fa9j9UTLSiZ1OvHZArIgyRYxnIwj6UWf0ynKZW3zG0RsMiXsT75DfqlHLt8Io1mfa_ZrJM53aPElvFUiYnAr7yVw-aoERyvkzGKpBZAfrARYgeUeZHtYnHt7P3NGrlGlKpXocCk_5JOUf4aKfs5YI-u8_X_Srl0bZfT9B_0gxh9Rhy4MFI0HbKk_STxo7buGrqDOWa0vfmllShoQi2zKbhuXEkxKDSp86RKCQIcU4sDJW46REoYkAbuDS3ywR3j3StA5ApwOUedFNbUXA16aaCKjACXYJmqu7k72NNrcCmBVnr9ds5kC3RVhm-vBih1Bs0zAsZNuAVUfa9z56qjXRU5z0W-8fwDCJ6FAJwJQrrthqu-1uKyqGyobN4fVMKMeuV86tsHunfwMBvzV80_igy7MUJeBNKwFRdcNy9aLVE9yh3W9p0Xs96CHRktZu2y0rGA0tKnrdS8h049qr2-YO29qmRvrQkbY2V6JAU8kubi6O2_CAWrCICpZV5CsOxvOKQZ-ryphJwz8cWuKeJmalnLxkP67oEAoXaIhGpFV-xHr3_OIJ0cZsIPCnI_bVkE4f8DsfwzDowAbwN6Cd8zyhTBlfbemsgtFoI8RMcX4ccubp-tUkLhYFXMOFGCRvlgLaZyxJPrLRsUgNM1Q0NSaRVWZ46bK5SEPfLySRQZpxYC_-TQMjwctjDK62zddqIS-Jkv4cp31EFK7rVzcQDHyA7cnHT8pbQlAmncqQxHhyI95cBftQhfTy_IqoP_EjFtnkDi_AGb0FM_cYixML5R5JNb3hvgUJsxpjCx3CmxCTBRf_VE8HEJkb71L_2coOCY0KjFHVJJUS5ShuAgYAHMYWlVqVlWp76gh9W8UrFidWCOxUlJ4IgDc7gdA9y4k2-hzQrlrpLpfRLFr2VCPUezDfUEFs9yDmXtYItEraPKCm-wi9DmtHpLS04WOwFcfio3ukUne9KFOFAJFj2p7-7YC2PZx9PNRbr6_HjY3MbI-TArWuuSmSxuLXyOgljVO5FYtaohQeBvgSr1cKL4-muuXjRuRDK8p4odyF0nds8cAbMd_r0vEolhnvX9dXVCu1nHBSSveFWe2S0ONog_bdGHDtogg8oGYJbWLjDQsr_ujxh9iVNPHuEprjO6AFEbve9U0xtRebrlWHnwH6Y6m0DuI5EFBasqUmVt6rT5OmPbHMvpx47wcjdIT7TQZ5sYwKQfA4HqNCuwFZQvqLdfy5fY1BTXN1HMts6bPi3WZRN1a0j-6R1agiQGnjoX4aA1-jmv4kisF_-_xvhYmmOT41cB1pDeBcQ21QpsgAW909tTzzdsgWW5UyavGUHFqbsISaOSHorPTSP7yVi-ffjxtG7gyxT0dNN60kTIwSp014BzWe3fuC5yCEl2gYEbVG7ykqbcaScqogVnj-JPxsdj31JnnvUbODoNB4efiVWsRHiUiDItqQwnH32L68kGqk_RlZ7MLjceSC7bZddaz6sfBGOEdWvzINRxScbRg2V5NXJLqny0dbH7nLDx5aAlWasgS6SLRsOc88Z1FMb-AgbZQeRmdoTkH4hxvXwI5jBdNKtdzFnlNDL7PVsEVCb01-opt2UNIvB3D8r6l9Rf9J1CaE9swIQn9hwXHsHJjiKr96c4U6e4tI3lu4iY1zXEGNgBkLIYi2XqchEgnHUZM7U_dlXHg2H_SCMV3CcDgduUKadvWu10qctgCSXAbIAwzh5fjM-wQVtgdtWIvfxkKuEuDSTXm8lIN5ZHfetCpsS7k6zJDUZhq9gkyQCa18GT8h32IqOWNl_QGkwqmb64Ji7bt-lJktZBrMqFGdq3EabQsw19yt_LTbKnimJjbe1bbOfnTjKxr8xN0U-NvLH8g36X0vWLshW7CblgP00cfMNooE_dAID1B5jJ4shsNPK2_cXsGYx8fUr3bf-3fXH1UZgJeOuOte9lRy_PUC7VU6QjEMre_tk2RshANbiUOiVh2kuWRFysqSGzZf7wJg_i4GctNod_51cy5q-Gcf_Y-J2AeBAclGpvSIzuSnNENkuIxvNBI_lS8F4WD59yEC8yi37yYWd11k8iJ-XUuBcWbxL0HCL9sWcndfq3ZGVpJqEUua-CtLuf2IKNnWQOHJjMBuGlGLzuCPy8xLU4Mci-hUCfc2TtuTwDH99uakSmzq9SwDfTJ48TdPZSsO5puKXzViRnlomm6c5lb1BZ_Z4QuLi61W6SPSNRDDjSAPB7XvFYZuojZvMyrmHG88qLP63kO8uldemRuYpqY4oczeGwgTci2DLSlDYuD4opcnbZavNjNSN_7UfD1N-COSpRcL4RVdBkdtshGvRgNmeCKbWHNX93muZwKWCg0fMQy4XEhhSfd_aBFeCrlx8DFN8IH-DxW3hbEaLOGaB0kIjkp7ftI0zO_AKJxnWTwTy3q4tGq252Q83lJdTvjOYMObgxUNfMOgjVLlrEGrJzFLi3bmJLllpqyDsEdYl3vergB1iBF6n-CNyWFXcFMx5-1ov_WmkUqfTpZ89UWGnzwmjl5dpDG-lMZfOYkk4SKkomkcPbi-3Cng4F3NfpE_N1jUlUPDERqCh_5dYJyoBzO1bImJfrNyQ7zf06qNgQmqQJd-HFoj8bEeBbm-rW6-YyRpp_GTrLq5Hjv5CZMUAyhXEgvz-J2fz8CvNjTEPQljm6RnDJRN_zStALy7XnKX8bEtMqKGWaCP0hx2IlIRsmKfUE8vw3kGoXJFTa85rr6VJ4B13Rk0YX3ZMMWwvHkzYqhWp_ISy5YVysTMJ-k85hnEg8I_qHgpqUAlgsKob9ZvQBntRbbwkK8sx5w-9KlciTdLJ1n-z38KeDS0CKiQ&cid=CAQSPABygQiDK6JitLTFtWaNhpqNVhIeVfjRDT00EFSnMS6bRkgcdouPTZndccBTZAx-mrN4PEM23K74utEulRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.visajourney.com%2F&ds=l&xdt=1&iif=1&cor=3281435173975183400&adk=2086295851&idt=227&cac=0&dtd=17

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48c46a1e885d41029c2c54fdbfb2cffbffc1fd618e249a04d608cc1117f67cee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37374
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 10EC 14 KB
1 KB 20ms
19ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 31 May 2023 12:52:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 10EC 2 KB
892 B 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:00:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66469
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:00:59 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/ Frame 10EC 22 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551debe8c4f0db7b25699af72a204caf099af55413f90eb34b5f546330d6187c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 18:49:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67156
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8798
x-xss-protection: 0
server: cafe
etag: 11317101923912129037
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 18:49:32 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6161 143 B
166 B 9ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1075
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:10:53 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 10EC 3 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 11:03:05 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5A00 1 KB
643 B 10ms
8ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 10512
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 10:33:36 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 10:33:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 10EC 19 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d47e9b04cf995a35fac50d2d39cd0006ef7e7f07f9373cad2fe5a207745f1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:01:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66467
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7987
x-xss-protection: 0
server: cafe
etag: 5788035530912182302
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:01:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 10EC 0
0 15ms
14ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRhjjYOV-3Y1sIrNyd5KM34MgdncmoH6-NFwe3dbfMdKjGZJu-rKGJcQ_oKUFwySF2ofOoun1tmdeQ-kY_yxlpxU755GQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 10EC 171 KB
53 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c3e04a3f536b4a6300aeee8ee1dbbfddaacaf29d9f44dadff76b136fab44e38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54244
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1684927996807358"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H2 200 0a0369f67a094afc57e3321b90807283.js Show response
www.gstatic.com/mysidia/ Frame 10EC 32 KB
14 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/0a0369f67a094afc57e3321b90807283.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88a51fe784c58c712a93f3f4e123e163e901042438df74cf793bdcf28eb090d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 29 May 2023 18:00:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 156477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13649
x-xss-protection: 0
last-modified: Sat, 27 May 2023 00:00:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 27 Aug 2023 18:00:51 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame D228 35 B
465 B 27ms
8ms Image
image/gif 2620:116:800d:21:93ca:31d8:d86e:38f6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMlCxbIFQHGbZcxPKrSA-qQ&google_cver=1&google_push=ATf1kGONnwkOjnwh_6anbTF_QoO9-cC-PBowsCgPDMlWSOrNqIXGo3P5hWhpHwJvC5a9n_jBNkNst0zo-z5aKOejFlC3Jac2yMSlHv8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET 5w3jqr4k
sync-tm.everesttech.net/upi/pid/ Frame D228 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D228
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESECtA885PiJO-frft6RANqr8&google_cver=1&google_push=ATf1kGMTO-3LzACBD-Q1OSnxlh_wI2qGvqHqqkaBBn382GtmhXcFYpO2P0lwDw32o5dtO9B7CTg3n8_TJIJ0tteLGMQcgmhrfglwT6E
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E20BAD250DCE40CF8769793E048E56EF&google_push=ATf1kGMTO-3LzACBD-Q1OSnxlh_wI2qGvqHqqkaBBn382GtmhXcFYpO2P0lwDw32o5dtO9B7CTg3n8_TJIJ0tte...

170 B
188 B

16ms
15ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E20BAD250DCE40CF8769793E048E56EF&google_push=ATf1kGMTO-3LzACBD-Q1OSnxlh_wI2qGvqHqqkaBBn382GtmhXcFYpO2P0lwDw32o5dtO9B7CTg3n8_TJIJ0tteLGMQcgmhrfglwT6E

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E20BAD250DCE40CF8769793E048E56EF&google_push=ATf1kGMTO-3LzACBD-Q1OSnxlh_wI2qGvqHqqkaBBn382GtmhXcFYpO2P0lwDw32o5dtO9B7CTg3n8_TJIJ0tteLGMQcgmhrfglwT6E
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 May 2023 13:28:48 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame D228 70 B
265 B 102ms
32ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEK3LXE--uDvnoUb4w2sw8vg&google_cver=1&google_push=ATf1kGNgUYPVLHw1MwEtzHQEUt-P2jSYJCrdnXXVhE9w3QOAn4gu0740Mhyqvv35Lco-UF6-wYuB8YqumjZZoxVCOW_nkCyz8ELygvs
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D228
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEJFykzTpMoXJNjyg3FfsSGo&google_cver=1&google_push=ATf1kGMHTUhs6lkWHZIx_0bjhwbNrOYFQ6a3Or-WCXOI16Ze3x_BEGxI24FaTetpfmFGaoMpYcwykbeQ6URxgmLyoY83...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEJFykzTpMoXJNjyg3FfsSGo&google_cver=1&google_push=ATf1kGMHTUhs6lkWHZIx_0bjhwbNrOYFQ6a3Or-WCXOI16Ze3x_BEGxI24FaTetpfmFGaoMpYcwykbeQ6URxgm...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMHTUhs6lkWHZIx_0bjhwbNrOYFQ6a3Or-WCXOI16Ze3x_BEGxI24FaTetpfmFGaoMpYcwykbeQ6URxgmLyoY83rsxjAQxfMBY&google_hm=uRX7J-PjSp2HvkHQmZUl...

170 B
188 B

19ms
19ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMHTUhs6lkWHZIx_0bjhwbNrOYFQ6a3Or-WCXOI16Ze3x_BEGxI24FaTetpfmFGaoMpYcwykbeQ6URxgmLyoY83rsxjAQxfMBY&google_hm=uRX7J-PjSp2HvkHQmZUlEg==

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGMHTUhs6lkWHZIx_0bjhwbNrOYFQ6a3Or-WCXOI16Ze3x_BEGxI24FaTetpfmFGaoMpYcwykbeQ6URxgmLyoY83rsxjAQxfMBY&google_hm=uRX7J-PjSp2HvkHQmZUlEg==
date: Wed, 31 May 2023 13:28:48 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D228
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEKItHHNRCGJ8DRFkbBqPUDU&google_cver=1&google_push=ATf1kGPKDSH_jn7vWwD-CrfO6G_6fkZO9u2cash6sfmYPvxD9YjLI1pVK-2MXUFjALBntbBk0NKVrnmV4Fi-XsjbPvLtyyl...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGPKDSH_jn7vWwD-CrfO6G_6fkZO9u2cash6sfmYPvxD9YjLI1pVK-2MXUFjALBntbBk0NKVrnmV4Fi-XsjbPvLtyylSRX6W_g&google_hm=eS1hX25md1FoRTJwRVhi...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGPKDSH_jn7vWwD-CrfO6G_6fkZO9u2cash6sfmYPvxD9YjLI1pVK-2MXUFjALBntbBk0NKVrnmV4Fi-XsjbPvLtyylSRX6W_g&google_hm=eS1hX25md1FoRTJwRVhieWw2dHZ1dWtMM05CNFk3bl9PNX5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGPKDSH_jn7vWwD-CrfO6G_6fkZO9u2cash6sfmYPvxD9YjLI1pVK-2MXUFjALBntbBk0NKVrnmV4Fi-XsjbPvLtyylSRX6W_g&google_hm=eS1hX25md1FoRTJwRVhieWw2dHZ1dWtMM05CNFk3bl9PNX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D228
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEFKuCpRvPHvb5ftjCBZhs4A&google_cver=1&google_push=ATf1kGMgeRR0Y9EdUq69giBQK8V5prmW6uDwzHz4OobJeRU8zac1GwOvyxtlzZwN54PjZJPA-0g0zjkaS6x2...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMgeRR0Y9EdUq69giBQK8V5prmW6uDwzHz4OobJeRU8zac1GwOvyxtlzZwN54PjZJPA-0g0zjkaS6x2ywcx6uLY0GBcXIb0XJ0

170 B
188 B

21ms
21ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMgeRR0Y9EdUq69giBQK8V5prmW6uDwzHz4OobJeRU8zac1GwOvyxtlzZwN54PjZJPA-0g0zjkaS6x2ywcx6uLY0GBcXIb0XJ0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMgeRR0Y9EdUq69giBQK8V5prmW6uDwzHz4OobJeRU8zac1GwOvyxtlzZwN54PjZJPA-0g0zjkaS6x2ywcx6uLY0GBcXIb0XJ0
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D228 0
12 B 14ms
14ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KXIwTLiODlrepHqE6dbXLQPzwlT2AhEG3RttThnyLOTOF6LoDur7kbNzi2OXgfDBTPORlb

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4651 0
0 49ms
45ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsums83JQj5R1pS1FC-hdx16neq_PE6I95ldR-APLtw_Dr-6wtUiqxlg8dvmk9OnWN1rmIt6hBcNhLWxuImN8yZr-dYXAyUhhihwas8sc1e5ay2PyDifR4Vtt2Ds1tUw99bBxyMEm5Ei9VeVvKZCF51lUKepdVoP9awc28WODlTrSDruK2T37uzcqrHyaF0c5Q58Ro62mg-FzKwOhQz4gOzKQBGVkFUXoiFtbRSpivAdXorrJtR77_RAEuSSvebpnRjeBTkvMKv4EKYql5Dwe_1VqJg9wR0ZOAR0TP93TBgh48A9wyXGdANFD-xSTfRxQfc_TW5d7nEXLYN9quBEsvA1L1aP1-2S3o3d-goLZ4ASyr4Tjr7A9RQlTMj7p1mlKfhY2Fo9LI9EKl-TD8wZc-wpMbrw7MRfLZL6C1i7seW1Hwls4BLyEKAgKuvUY3wph9_1nsn66UfbQF2HmtBWJc9wxOvfyhcXrv2Z37z8agzHVlN-HayU2FcMbRehFIccLDsb5nD3z7z8oCpBPaG6ZmEJum42sM81OTOATdGeqUBzq-UCXSl5ibjIeF9wTfWn95mbSvIaszEmkji70XksVgIdPgOA_5WH_3jmlAajfiEVPYga2g0hfRNG6oXlqVORPN3O7bQLS_VB8L4gDJyIL4BVX43rmcumYJMdJdhmAV8HyEZOLz_pmUecRJ3nJXDvjE_ZKqLxSX97Fa79W-Yb6R4CU7dWeiX2U1mifcLd8FI1huTEgfW9mfj6tmCteyrMZdpqWoCaHGff0C-EF2osgRntBp5RIFe9THKaR2aGuVmERLepsbB11wi8ZFEK0ywuDSmjOL-EB3P0zh85gj80JbR78Jk7nVJ2w7Gwi0cyy3a6vxbAPl-_I1ECGVH1oPRIlQ-dNtm2ffiXpKvLAnVgwEfvpjWAUfHs6g4_vrdvFKmk8xogbXWoSXrYQp8iQC4Wb9kwuteHcRRX5ybt4yRvbmouPDqVdcCodqh09IExNKXHJXzu15Az9404o6LwdFncVee7E6H_g326fLLZBIdygHYXbhaIiQ8GPiBEi0cTzp4rY5U6zhk2iBL7uyPD2PLYgDrjSyC5duy7QLbMLov2ZozVx-aTjf6CeQ9MEJJPvHdCboyTU_eqPO8lS5phuJm63pcs46qS3fihqJlNE7NR8MnRT05hnR7TRYj4gLqZ6YAkA-pyed1NmwOUnJw0MbKEkILMjBbNbXkMnbyAm2jBuZOXnVxr38EACiyz3rvsmm3YI251LYbvviw41b35d2R5cuRSEIhfhBh_h5f4QyY_3ryP09TzyDk&sai=AMfl-YRZfn_f7yvKAG74GnihVHKPjY3JsvUOLVS1-NT3ST-9q0yclGVaRhNdF8Q7n4cG_HfmzkL8fl1Jh44ZEP5_8IxnFaDSKeU3y0f_IlHwK7jFEAeN1EBuPo56s3aatfF-1m19o0o7ANxzm-jtFMFR_1Tk9VkJ10isMsQOPFJJvp6JHReYRTMSGdueJ0-o9aeppZCHjjqszDgGkKtE_KlJId9hNZgvXINY5oEzbz1ExMq0qKjZz2zOgTCfkqnWyGCjjw2Rlfkijyx1Tsd4kAj8ryGWjOokR_2I&sig=Cg0ArKJSzPidFXqxCu5gEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=110&vt=11&dtpt=109&dett=2&cstd=0&cisv=r20230525.51728&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 2367 2 KB
1 KB 40ms
12ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=ZHdLjwAIgx8A-Qi_AAGfkXmC2rcmobY4qPsI4A&u=%7CBnQ%2BM9Fep1zpd%2BGfcgF4vWkwdspSzDfjuKZt6UyFJXw%3D%7C&c1=d4_i42wbpE2NRhSHxThdXdeadzG9gosNB-Ap14Pg0HmFAf1GHAR2jhV7Kd6SKvkZ2c775jfyZY6fGSNGGFpANeU-bVyDuEyqZdUG7FfVguKjFFL_1-YhDmZMS8XTB7NdjNMEVyBMpwezplG5cZP4NIGRCeO4qDi09YpOVJVXvmCP1xmqCS-vVZfPY8MAKKfugLVWUR9qPSYFTGwaNa3ziEVuMtbIAPrOC0zcAFDRApDAkzxulf6EP8AvHplk3BiQjVyj6WLi3bBaKLYhyIP4ddwfipGdD-7oMIVOrQnImHzepC0I0O_dTZbPuM1bIqvwf-DmilmJwDFkArRR-1INWiVbyI_1JEifnvsBzOqEkjHSOvWxhCWaJoRkKRnYaKYqhYJRje7AUrpawuUtu_w_bXK78fNttvBQzpH9bEn1zOdUkbh5RzPkTLWFkTXsP3QrYEs9iceZ5USOnSZa7lomDHUwc-6PP5HGdq7HvWEBbPhkEh9w4-DHAO82eTDyCGu3DJ1Sm1dM3LOvdJ7jDjMXo5xATtWPNFWDZ-GB088-_EDZSYLq2DgMal4Z7u9f18shvFrOtd1Piu5Gfwq9y7U1rQ8lBcxrW2ZXoececn07Ngq4OrroqRr1LjJInV0U14gv&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDtwuj0t3ZJ-GIr-R5LcPkb-G8AzJntKxXMWMi-CaAcCNtwEQASAAYJXikIKgB4IBF2NhLXB1Yi0zNDA3NTA4NDY3Nzg4MjYzyAEJqQIIZ8AONumxPqgDAaoE5wFP0Ar-Qv3eCS6hhi2XxRSCmwYlGoGfs7keoNMFl4BMGmLJB2dQWp5K8ZgBkcWYtC5hRqttq22mceYIZX4INs3MYpsDgx0Mt5ITQ4dhhx8wiLPvwEFtWpAo2i57pou1XjEDdg9x2fv2-ODLBxKV_XHJIOOqCZ23ULAhaGBhozM2-ukwV3CSKXwm84ZJrrTLbUWKQvcplMtyt3T--eN6c_kHKwssFxs7rVBuwRzuWvHl7y4cldD1iQVflJFbHtMqvWVRhgK33iAZOeCPyjhE6EjGyR5azu0SAppZgOvi7D10g9y8-GPVh3KABpL3rPf7vsa7K6AGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCA8IgOGAEBABMgKqAjoCgED6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_0n91DsVexn7CjkHXiNd8foJW-B0A%26client%3Dca-pub-3407508467788263%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 2367 2 KB
1 KB 41ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 2367 308 B
636 B 13ms
13ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 2367 293 B
621 B 17ms
16ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 2367 43 B
348 B 51ms
14ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=JMVy82btm2aQz_R_NmP87aSpoaePgYQ162JzOv6KQ9ECLxF3Vxf5MthCWDQdJvPeBnpnk080iOhEWzhLatEbWhlUaTVW03sUR7l_lTHqK75GMIZbmCUMASoC82p9YTajJBHSzzu_bfb1XGXIR8FFpQ-Uvwo6-tj0SAgskTgXOmNK9sCZKBUClj6X4eWVrMgpgsrTqlwKVbC1tAn4q0M1hXJ323YqtKFjZWnBTkbW83WTZvrFQM2148KRTsP-dPdU8EFY3coz4jgD2M0nZJGFkKHvNaNLIjSIh0k9qkTl9glyxgvTkh49QXme-m8S_dQSnhuLpiTOXCP-OeMLP37q2wBLODEzogSkNa_0nF9yJNeV_FUDTcvLwftyjyEDnX7sndqywBXxHPBP56X2CZTVO4JW2hdgsy-8CiAoSnV-o8ZuibJ5

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1859636
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FB7D 22 KB
8 KB 8ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 57096
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame CCC4 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de26f8b58773d7da466e6f88693e398aa053a24d8556c61df8878d72f0685bf0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame D159 0
187 B 59ms
11ms Image
text/plain 98.98.134.242
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESECpGdkTfS2ViwBh7agkvTBo&google_cver=1&google_push=ATf1kGO_9bcjyjsaqQAF9wmZ91z7ht260GIZA7Wg97pSBwkg6y5Lcto8isYQzcAmIQ2RlLFb9D-B7lKcBG8hQ2dcis1Blh6vYd9s4iuEb-MfRG6ImN-axBxD06BBgczPrl-FxZV8Xt_8xR4
Requested by: Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.242 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 31 May 2023 13:28:47 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D159
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBuMM-Jpwc0e8lggUreEOvw&google_cver=1&google_push=ATf1kGPO7nOV1rkcu9LEPGgwR68072ZWlNDvC_d32aPDJ-Oa0aSn1ZG1sMpxZVftArRV5QEndaQ3I9atcxSD_fc6...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0QYXKiv0RDWiQ-SEGrPZWQ2&google_push=ATf1kGPO7nOV1rkcu9LEPGgwR68072ZWlNDvC_d32aPDJ-Oa0aSn1ZG1sMpxZVftArRV5QEndaQ3I9atcxSD_fc6ZYUvPhbx9mvWJ1...

170 B
188 B

25ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0QYXKiv0RDWiQ-SEGrPZWQ2&google_push=ATf1kGPO7nOV1rkcu9LEPGgwR68072ZWlNDvC_d32aPDJ-Oa0aSn1ZG1sMpxZVftArRV5QEndaQ3I9atcxSD_fc6ZYUvPhbx9mvWJ1EoEIbe0GxXhzx9jCpHjwuyCnklHE8zdU0Fi9J5jmA

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:48 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=0QYXKiv0RDWiQ-SEGrPZWQ2&google_push=ATf1kGPO7nOV1rkcu9LEPGgwR68072ZWlNDvC_d32aPDJ-Oa0aSn1ZG1sMpxZVftArRV5QEndaQ3I9atcxSD_fc6ZYUvPhbx9mvWJ1EoEIbe0GxXhzx9jCpHjwuyCnklHE8zdU0Fi9J5jmA
x-host: tde-deliveryengine-production-5dc64df5dd-w9w48
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D159
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEK8L4ODExXBFLI4HFM3Qcjg&google_cver=1&google_push=ATf1kGNHLit-1T3wwgKs4WXepmyQzq-eevI06Ani_a_3xu31qpNGpN0KfHLoTFjFonqFFX0hTA-zcm0m0qmiQdz0JAK14Vt...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEK8L4ODExXBFLI4HFM3Qcjg&google_cver=1&google_push=ATf1kGNHLit-1T3wwgKs4WXepmyQzq-eevI06Ani_a_3xu31qpNGpN0KfHLoTFjFonqFFX0hTA-zcm0m0qmiQdz0JAK14...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNHLit-1T3wwgKs4WXepmyQzq-eevI06Ani_a_3xu31qpNGpN0KfHLoTFjFonqFFX0hTA-zcm0m0qmiQdz0JAK14VtIGeE5wbC...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNHLit-1T3wwgKs4WXepmyQzq-eevI06Ani_a_3xu31qpNGpN0KfHLoTFjFonqFFX0hTA-zcm0m0qmiQdz0JAK14VtIGeE5wbCzxtMiM0Cyx_EiccV_ALsHjZtO1d1r4EK9PaGAAQ

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNHLit-1T3wwgKs4WXepmyQzq-eevI06Ani_a_3xu31qpNGpN0KfHLoTFjFonqFFX0hTA-zcm0m0qmiQdz0JAK14VtIGeE5wbCzxtMiM0Cyx_EiccV_ALsHjZtO1d1r4EK9PaGAAQ
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D159
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJSBTZijlt76BRI3ijyWknA&google_cver=1&google_push=ATf1kGMEmV9FlP6uogjtunboytKEF60wZUNcBenAlhRfpBV4Jc4g8rV4u2QntxffuYZN--BQ4t7...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElCUVUyOEQtWS1GMlBB&google_push=ATf1kGMEmV9FlP6uogjtunboytKEF60wZUNcBenAlhRfpBV4Jc4g8rV4u2QntxffuYZN--BQ4t7qXMKS3LA87G9R7XH80Sm45YjVrzllR...

170 B
188 B

20ms
19ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElCUVUyOEQtWS1GMlBB&google_push=ATf1kGMEmV9FlP6uogjtunboytKEF60wZUNcBenAlhRfpBV4Jc4g8rV4u2QntxffuYZN--BQ4t7qXMKS3LA87G9R7XH80Sm45YjVrzllR2Ne5xzEMuZkd3LE-OggdAa5gQMProPSXWxcGaQ

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElCUVUyOEQtWS1GMlBB&google_push=ATf1kGMEmV9FlP6uogjtunboytKEF60wZUNcBenAlhRfpBV4Jc4g8rV4u2QntxffuYZN--BQ4t7qXMKS3LA87G9R7XH80Sm45YjVrzllR2Ne5xzEMuZkd3LE-OggdAa5gQMProPSXWxcGaQ
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D159
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESELEF3GBPvQr5XUTlq-UQukU&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESELEF3GBPvQr5XUTlq-UQukU&google_hm=ZHdLkN5vuIAGCgRPcnnGsgAAFFQAAAIB&google_nid=index&google_push=ATf1kGPyYK9V-Kk6RjttkKL2GfdKeOOztutP0...

170 B
188 B

21ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESELEF3GBPvQr5XUTlq-UQukU&google_hm=ZHdLkN5vuIAGCgRPcnnGsgAAFFQAAAIB&google_nid=index&google_push=ATf1kGPyYK9V-Kk6RjttkKL2GfdKeOOztutP0T9rBNV-ffwg7I7Cvk5-z1DKLYJ6jUneCQupJEfFZ68DCfSQ5GgMbYFqsdKggNYCw4PQd_U6kKQK7uXCb1Y8P1BbY9zvgIChzgNvpTrwGyI

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESELEF3GBPvQr5XUTlq-UQukU&google_hm=ZHdLkN5vuIAGCgRPcnnGsgAAFFQAAAIB&google_nid=index&google_push=ATf1kGPyYK9V-Kk6RjttkKL2GfdKeOOztutP0T9rBNV-ffwg7I7Cvk5-z1DKLYJ6jUneCQupJEfFZ68DCfSQ5GgMbYFqsdKggNYCw4PQd_U6kKQK7uXCb1Y8P1BbY9zvgIChzgNvpTrwGyI
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D159
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEE...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ATf1kGOrT1PRabGclWJtOPS-BV0aBYH-DrGgggHWoR6Q5SCBNUz3RKyrHzw60xTazjaQZ-nAkmik-IFpqRXLklvmLHY0ZDhnmxs1Ix4fiUvCUvwyt0jWmcm5IlrNsLMESoE...
https://sync.targeting.unrulymedia.com/csync/RX-16a0e8a5-3e38-4aff-b81d-5277e8972e9f-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGOrT1PRabGclWJtOPS-B...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGOrT1PRabGclWJtOPS-BV0aBYH-DrGgggHWoR6Q5SCBNUz3RKyrHzw60xTazjaQZ-nAkmik-IFpqRXLklvmLHY0ZDhnmxs1Ix4fiUvCUvwyt0jWmcm5IlrNsLMESoEhMbHl...

170 B
188 B

20ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGOrT1PRabGclWJtOPS-BV0aBYH-DrGgggHWoR6Q5SCBNUz3RKyrHzw60xTazjaQZ-nAkmik-IFpqRXLklvmLHY0ZDhnmxs1Ix4fiUvCUvwyt0jWmcm5IlrNsLMESoEhMbHlg8gtSlo&google_hm=Axag6KU-OEr_uB1Sd-iXLp8

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGOrT1PRabGclWJtOPS-BV0aBYH-DrGgggHWoR6Q5SCBNUz3RKyrHzw60xTazjaQZ-nAkmik-IFpqRXLklvmLHY0ZDhnmxs1Ix4fiUvCUvwyt0jWmcm5IlrNsLMESoEhMbHlg8gtSlo&google_hm=Axag6KU-OEr_uB1Sd-iXLp8
date: Wed, 31 May 2023 13:28:49 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX16a0e8a53e384affb81d5277e8972e9f003
content-type: text/html

GET
H2

200

/
onetag-sys.com/match/ Frame D159
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESELQfgFz0pIJv-RA66ouDFfE&google_cver=1&google_push=ATf1kGPmvsb32Jh_qCwHOcmr39rsqpx-4qlU4GaZ7_3_J3KywGQIQ5-BcuDhs3C3TNa5SIMHo7W2QEHf1SA...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGPmvsb32Jh_qCwHOcmr39rsqpx-4qlU4GaZ7_3_J3KywGQIQ5-BcuDhs3C3TNa5SIMHo7W2QEHf1SAyDv-JXyn7qjIQlGIgrsmSNOwFbBca7CF1JLRo...
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

7ms
7ms

Image
text/plain

51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D159 0
12 B 15ms
14ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IgygwgTRSg3HIrP7BbbtBlF-vN1Y-FEhEkwzncKbzFb-x4mlhRkqv9d-1WTksUSsqrV-T5dQ

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 2367 12 KB
5 KB 28ms
12ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 373279
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aZChP47ltCBnE4v6MJ9Hz990c5zIo7wvnUr1V8Bj1zbrYJfnyVoiFmkUoMnzQxInfFrjZpCv%2FCFJubwb35ZCafJouP1RjjXdcLBOdcNygDFBd5iPHrTLfPVLC4Dt8Z1R23asI5IWdpzXUKeaozBc6efa"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7cff8fe7ac8b1d86-FRA
expires: Mon, 20 May 2024 13:28:48 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 2367 12 KB
6 KB 17ms
17ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2367 4 KB
4 KB 70ms
38ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?h=244&m=0&partner=10391&q=80&r=0&u=http%3A%2F%2Fstatic.nl3.eu.criteo.net%2Fdesign%2Fdt%2F10391%2F180604%2Fa9e8a35c9e904625b41a29aaa1246f8b_thomas_sabo.png&v=3&w=196&s=QejJwCTng7f8rWBqBxcia1eA

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

fa40366b6c4e2b6647d02054bebebe1bcddf9d011e0b8e4d90b8a18ba699f8ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
content-length: 3731
expires: Sat, 11 May 2024 02:14:55 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2367 10 KB
10 KB 72ms
39ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=10391&q=80&r=0&u=https%3A%2F%2Fwww.thomassabo.com%2Fdw%2Fimage%2Fv2%2FAAQY_PRD%2Fon%2Fdemandware.static%2F-%2FSites-ts-master-catalog%2Fdefault%2Fdw8a56df12%2Fproduct%2FT%2FTR%2FTR2434%2FTR2434-496-6.png%3Fsfrm%3Dpng&v=3&w=400&s=h91tipI5B2wCbsLL0id-ifMb&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4ba88e829059847b7b531bdfd177686bc3d26debc7244b850e66c424e1c7c979

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
content-length: 10306
expires: Tue, 13 Jun 2023 22:16:21 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2367 39 KB
39 KB 59ms
26ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=10391&q=80&r=0&u=https%3A%2F%2Fwww.thomassabo.com%2Fdw%2Fimage%2Fv2%2FAAQY_PRD%2Fon%2Fdemandware.static%2F-%2FSites-ts-master-catalog%2Fdefault%2Fdwf1c83179%2Fproduct%2FP%2FPE%2FPE828%2FPE828-994-7.png%3Fsfrm%3Dpng&v=3&w=400&s=wnsCwJ5rVtOnxB-QUgGvP3ct&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

6e1a86b8a89c880b5fcf93ddea265bb03f6d2f112ab369067dcaf63b67956d2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
content-length: 39830
expires: Tue, 13 Jun 2023 09:52:29 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2367 11 KB
11 KB 69ms
37ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=10391&q=80&r=0&u=https%3A%2F%2Fwww.thomassabo.com%2Fdw%2Fimage%2Fv2%2FAAQY_PRD%2Fon%2Fdemandware.static%2F-%2FSites-ts-master-catalog%2Fdefault%2Fdw109a158e%2Fproduct%2FC%2FCR%2FCR689%2FCR689-643-14.png%3Fsfrm%3Dpng&v=3&w=400&s=oKlY7xpsz5drHiq4oKdFh8SN&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

a639d7d9633ac6a172e7e659490de59325297cbd941d4ce9e8133d44dd7aef32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=2592000
content-length: 11340
expires: Sat, 17 Jun 2023 14:39:55 GMT

GET
H2 200 img
imageproxy.eu.criteo.net/img/ Frame 2367 10 KB
10 KB 46ms
14ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/img/img?cq=256&h=400&m=0&partner=10391&q=80&r=0&u=https%3A%2F%2Fwww.thomassabo.com%2Fdw%2Fimage%2Fv2%2FAAQY_PRD%2Fon%2Fdemandware.static%2F-%2FSites-ts-master-catalog%2Fdefault%2Fdwea3c0758%2Fproduct%2FE%2FE%2FE0013%2FE0013-236-130.png%3Fsfrm%3Dpng&v=3&w=400&s=gz59dwqlHExdV7RTRx9nX4X5&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

bb0f635bc2910780446a35e240172cc8da250be4bfc8a1655b3aa08900c35813

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:47 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=2592000
content-length: 10050
expires: Fri, 16 Jun 2023 10:30:02 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 2367 0
128 B 44ms
13ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=xD2X-_eIMyqkT6ne6bxSTdhZBJxfxeKOjW00Hg5fvUOWVeLIkSsogAEdiyUuuUVe_8aBaRLm9WEnJ6ZqDNnH5Tc0TovXeFVndWrEycIZzGHfIBUGaBOt7ayz8YnOveQzMPFpsmVqHL8MIibR4xlcxNtI2pv2WyLrNZW6bN249zRxDzPJazSHfj2n0Rjub-scIbrsBiNC7IlSKISdm3wXOMxUgtGIa0IO8QFI7UOY6oz2Zya31YGPqJS_YdvXspuQLBUaJw&sds=2&rev=86437.3&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 2367 2 KB
1 KB 14ms
14ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 2367 2 KB
1 KB 19ms
19ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 15E3 172 KB
60 KB 30ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Origin: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 10:17:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11484
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Jun 2023 10:17:24 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/ Frame 15E3 11 KB
4 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AVoTIStzOeeHK6l_VmCJ6vwRxzV0e9SyjL_Hvpvo_WkW4Fdl962IO8zI9rJ-m79NMJ8-8uusps_4aSnIR6ZyQs8T8Xcf--NtEN3DqhtTrV0ImU8qL9gJIwvqlwvEFfw3Is7_Nd2ARdI3K8kBmkx6A9mSVsSmTXPYqxpi1k08IxH0OdSKU&dbm_d=AKAmf-DSeBBQWmtwM9cfEDOdj6MRGQyDVTlkPihyrb959XqAgVaJmg9CvK-lcmRkkwv8F5TW1vlurYFm000uE40Z2dmazlfTYT16yZRzhXdlyjCp9y_2pw0sb2peQ6ZPq3CGKV5MGnTEAgee80J7eU93uUk5JvuZ_SBx2LAEr4pHxN8q8ZEitTZ3NAYFp7t-OgAMstiBOFpAb6ASYtb39A9qOtXlEoWZnkOXwRUUwfFjbClRj_BPm1RyvtwZzLnebWakAnUdLCoMWeAnVcrxL_PatLdhp4eVGAb0DVYgqVUkp14Y8lB5pjIUSIOWho3LdNAOcB6z9wz0CTz3c-aR-fa6fCVPCmJ_yVikkdFAeiQ2svGsy0SW8LCxx2EYzYFG-VOFa3YOcjt_Ftv2AG6ZY6HtvsoGWPqkoF3x3NAAUtZhU03dABcNeBUrohtMGlSUVB5ZA1Ekk-cC8V09HOCQ2f3v1DHPtSm9nXJqJsDXOmydj-TD8IrYhSm7kks3p-Ig7KaJnS2GmJp9zVFrmYPvWgRAMoCapPJytysH-lhK4rT5S7b3fn8KbtmKcuKs6c9ow1DKa4GuX4TrVZ1Blot6bS08mHuc6n-NTlaPmaoYDgw2tmSJW7y-yje_MpoKZ1fTSjyiJ9-HT2FFGOL_vpntTzgHRlEJywjOl1vSIP-MP2tJY3e7n8clcyHbWMiMbFXsvQ0tBxVyO05MQh16DroDRZ0x-HNYk_xVj55Xtq9gTiuVgYyiC_UH0PGjHdArIjKk5i4_BSQNAa8Aps0F0wLz6EqbLWobRuOpK36R0YDE8CKUuNa53oVNIhXSuRs-9AXCJSEULeXNLWSK0Fa9j9UTLSiZ1OvHZArIgyRYxnIwj6UWf0ynKZW3zG0RsMiXsT75DfqlHLt8Io1mfa_ZrJM53aPElvFUiYnAr7yVw-aoERyvkzGKpBZAfrARYgeUeZHtYnHt7P3NGrlGlKpXocCk_5JOUf4aKfs5YI-u8_X_Srl0bZfT9B_0gxh9Rhy4MFI0HbKk_STxo7buGrqDOWa0vfmllShoQi2zKbhuXEkxKDSp86RKCQIcU4sDJW46REoYkAbuDS3ywR3j3StA5ApwOUedFNbUXA16aaCKjACXYJmqu7k72NNrcCmBVnr9ds5kC3RVhm-vBih1Bs0zAsZNuAVUfa9z56qjXRU5z0W-8fwDCJ6FAJwJQrrthqu-1uKyqGyobN4fVMKMeuV86tsHunfwMBvzV80_igy7MUJeBNKwFRdcNy9aLVE9yh3W9p0Xs96CHRktZu2y0rGA0tKnrdS8h049qr2-YO29qmRvrQkbY2V6JAU8kubi6O2_CAWrCICpZV5CsOxvOKQZ-ryphJwz8cWuKeJmalnLxkP67oEAoXaIhGpFV-xHr3_OIJ0cZsIPCnI_bVkE4f8DsfwzDowAbwN6Cd8zyhTBlfbemsgtFoI8RMcX4ccubp-tUkLhYFXMOFGCRvlgLaZyxJPrLRsUgNM1Q0NSaRVWZ46bK5SEPfLySRQZpxYC_-TQMjwctjDK62zddqIS-Jkv4cp31EFK7rVzcQDHyA7cnHT8pbQlAmncqQxHhyI95cBftQhfTy_IqoP_EjFtnkDi_AGb0FM_cYixML5R5JNb3hvgUJsxpjCx3CmxCTBRf_VE8HEJkb71L_2coOCY0KjFHVJJUS5ShuAgYAHMYWlVqVlWp76gh9W8UrFidWCOxUlJ4IgDc7gdA9y4k2-hzQrlrpLpfRLFr2VCPUezDfUEFs9yDmXtYItEraPKCm-wi9DmtHpLS04WOwFcfio3ukUne9KFOFAJFj2p7-7YC2PZx9PNRbr6_HjY3MbI-TArWuuSmSxuLXyOgljVO5FYtaohQeBvgSr1cKL4-muuXjRuRDK8p4odyF0nds8cAbMd_r0vEolhnvX9dXVCu1nHBSSveFWe2S0ONog_bdGHDtogg8oGYJbWLjDQsr_ujxh9iVNPHuEprjO6AFEbve9U0xtRebrlWHnwH6Y6m0DuI5EFBasqUmVt6rT5OmPbHMvpx47wcjdIT7TQZ5sYwKQfA4HqNCuwFZQvqLdfy5fY1BTXN1HMts6bPi3WZRN1a0j-6R1agiQGnjoX4aA1-jmv4kisF_-_xvhYmmOT41cB1pDeBcQ21QpsgAW909tTzzdsgWW5UyavGUHFqbsISaOSHorPTSP7yVi-ffjxtG7gyxT0dNN60kTIwSp014BzWe3fuC5yCEl2gYEbVG7ykqbcaScqogVnj-JPxsdj31JnnvUbODoNB4efiVWsRHiUiDItqQwnH32L68kGqk_RlZ7MLjceSC7bZddaz6sfBGOEdWvzINRxScbRg2V5NXJLqny0dbH7nLDx5aAlWasgS6SLRsOc88Z1FMb-AgbZQeRmdoTkH4hxvXwI5jBdNKtdzFnlNDL7PVsEVCb01-opt2UNIvB3D8r6l9Rf9J1CaE9swIQn9hwXHsHJjiKr96c4U6e4tI3lu4iY1zXEGNgBkLIYi2XqchEgnHUZM7U_dlXHg2H_SCMV3CcDgduUKadvWu10qctgCSXAbIAwzh5fjM-wQVtgdtWIvfxkKuEuDSTXm8lIN5ZHfetCpsS7k6zJDUZhq9gkyQCa18GT8h32IqOWNl_QGkwqmb64Ji7bt-lJktZBrMqFGdq3EabQsw19yt_LTbKnimJjbe1bbOfnTjKxr8xN0U-NvLH8g36X0vWLshW7CblgP00cfMNooE_dAID1B5jJ4shsNPK2_cXsGYx8fUr3bf-3fXH1UZgJeOuOte9lRy_PUC7VU6QjEMre_tk2RshANbiUOiVh2kuWRFysqSGzZf7wJg_i4GctNod_51cy5q-Gcf_Y-J2AeBAclGpvSIzuSnNENkuIxvNBI_lS8F4WD59yEC8yi37yYWd11k8iJ-XUuBcWbxL0HCL9sWcndfq3ZGVpJqEUua-CtLuf2IKNnWQOHJjMBuGlGLzuCPy8xLU4Mci-hUCfc2TtuTwDH99uakSmzq9SwDfTJ48TdPZSsO5puKXzViRnlomm6c5lb1BZ_Z4QuLi61W6SPSNRDDjSAPB7XvFYZuojZvMyrmHG88qLP63kO8uldemRuYpqY4oczeGwgTci2DLSlDYuD4opcnbZavNjNSN_7UfD1N-COSpRcL4RVdBkdtshGvRgNmeCKbWHNX93muZwKWCg0fMQy4XEhhSfd_aBFeCrlx8DFN8IH-DxW3hbEaLOGaB0kIjkp7ftI0zO_AKJxnWTwTy3q4tGq252Q83lJdTvjOYMObgxUNfMOgjVLlrEGrJzFLi3bmJLllpqyDsEdYl3vergB1iBF6n-CNyWFXcFMx5-1ov_WmkUqfTpZ89UWGnzwmjl5dpDG-lMZfOYkk4SKkomkcPbi-3Cng4F3NfpE_N1jUlUPDERqCh_5dYJyoBzO1bImJfrNyQ7zf06qNgQmqQJd-HFoj8bEeBbm-rW6-YyRpp_GTrLq5Hjv5CZMUAyhXEgvz-J2fz8CvNjTEPQljm6RnDJRN_zStALy7XnKX8bEtMqKGWaCP0hx2IlIRsmKfUE8vw3kGoXJFTa85rr6VJ4B13Rk0YX3ZMMWwvHkzYqhWp_ISy5YVysTMJ-k85hnEg8I_qHgpqUAlgsKob9ZvQBntRbbwkK8sx5w-9KlciTdLJ1n-z38KeDS0CKiQ&cid=CAQSPABygQiDK6JitLTFtWaNhpqNVhIeVfjRDT00EFSnMS6bRkgcdouPTZndccBTZAx-mrN4PEM23K74utEulRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.visajourney.com%2F&ds=l&xdt=1&iif=1&cor=3281435173975183400&adk=2086295851&idt=227&cac=0&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 18:59:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66572
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 18:59:16 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/ Frame 15E3 29 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230525/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:25:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 65009
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:25:19 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 15E3 41 KB
15 KB 13ms
10ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 07:39:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 107355
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 07:39:33 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 5A00
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOp-TjKrUG1KlZ8FsJEF-O0&google_cver=1&google_push=ATf1kGO7Qw1ZCf9MO7cr1bFChOuOXfzymbG8ulpUA-8omYh4kINFWRTG0uBqP3p9xrugWtRiVoGw_4Va84Ox2udaXuCb9Oo6xHV_D...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjY1NDAyNDkwNzY2NDcwMTMzMg==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEJveA6DDNSRlLLfMOLbT5kA&google_cver=1

43 B
398 B

28ms
25ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEJveA6DDNSRlLLfMOLbT5kA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEJveA6DDNSRlLLfMOLbT5kA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A00
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEMlCxbIFQHGbZcxPKrSA-qQ&google_cver=1&google_push=ATf1kGMi3KvnuJfH_CbISoUcSM6eGWfnSR2QdT7mdie3Nbx2txwKaYYD8d...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGMi3KvnuJfH_CbISoUcSM6eGWfnSR2QdT7mdie3Nbx2txwKaYYD8dqsOx-vIWNeVUzlyjR5VQuYHZoxid50uwd7-bs0ILkFsYsvtnhyxMHlvWtulXLFmzw...

170 B
188 B

17ms
16ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGMi3KvnuJfH_CbISoUcSM6eGWfnSR2QdT7mdie3Nbx2txwKaYYD8dqsOx-vIWNeVUzlyjR5VQuYHZoxid50uwd7-bs0ILkFsYsvtnhyxMHlvWtulXLFmzwYROzgEEpo4Gc5Gj53X2AXDlEi1U7SNFk8OyY&google_hm=z_JyxI5WxMqO5FEazsBhPQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGMi3KvnuJfH_CbISoUcSM6eGWfnSR2QdT7mdie3Nbx2txwKaYYD8dqsOx-vIWNeVUzlyjR5VQuYHZoxid50uwd7-bs0ILkFsYsvtnhyxMHlvWtulXLFmzwYROzgEEpo4Gc5Gj53X2AXDlEi1U7SNFk8OyY&google_hm=z_JyxI5WxMqO5FEazsBhPQ
pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A00
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEKCYXjmaHUAgXqxFcPlHYPg&google_cver=1&google_push=ATf1kGM2RwGU7pv11bs464OCfQxe3Ez1zlPJsT8AkshQo_oMzpdtVzwQIraqeiwXg_4esuF9c_dqBkCl89aUrT56...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGM2RwGU7pv11bs464OCfQxe3Ez1zlPJsT8AkshQo_oMzpdtVzwQIraqeiwXg_4esuF9c_dqBkCl89aUrT56uWHY6fk6wQH0Zve6lH_oRR2KHVrf9u...

170 B
188 B

21ms
21ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGM2RwGU7pv11bs464OCfQxe3Ez1zlPJsT8AkshQo_oMzpdtVzwQIraqeiwXg_4esuF9c_dqBkCl89aUrT56uWHY6fk6wQH0Zve6lH_oRR2KHVrf9ue-BbYJxiwiFyNEwamwGC7MEfK2lmhddv48qitISw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 31 May 2023 13:28:48 GMT
Server: MT3 851 9bd98ae master zrh-pixel-x27 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGM2RwGU7pv11bs464OCfQxe3Ez1zlPJsT8AkshQo_oMzpdtVzwQIraqeiwXg_4esuF9c_dqBkCl89aUrT56uWHY6fk6wQH0Zve6lH_oRR2KHVrf9ue-BbYJxiwiFyNEwamwGC7MEfK2lmhddv48qitISw
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 31 May 2023 13:28:47 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A00
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESECtA885PiJO-frft6RANqr8&google_cver=1&google_push=ATf1kGNpWo4D26bfwg68TfVPBtKmDjTIAIxjnTgpFdqm3vV8MPfJPvameBFD_WQk2cDqRu1Q7B6b6KMvIphRjzZ9U1rkCI9_yxu8ko...
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E20BAD250DCE40CF8769793E048E56EF&google_push=ATf1kGNpWo4D26bfwg68TfVPBtKmDjTIAIxjnTgpFdqm3vV8MPfJPvameBFD_WQk2cDqRu1Q7B6b6KMvIphRjzZ...

170 B
188 B

33ms
33ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E20BAD250DCE40CF8769793E048E56EF&google_push=ATf1kGNpWo4D26bfwg68TfVPBtKmDjTIAIxjnTgpFdqm3vV8MPfJPvameBFD_WQk2cDqRu1Q7B6b6KMvIphRjzZ9U1rkCI9_yxu8koImsbdk-QOEN7t-FLVcap9vSn0Iy_IAk27tG4utp60w_cjR3gUD6AU5L8o

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:48 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=E20BAD250DCE40CF8769793E048E56EF&google_push=ATf1kGNpWo4D26bfwg68TfVPBtKmDjTIAIxjnTgpFdqm3vV8MPfJPvameBFD_WQk2cDqRu1Q7B6b6KMvIphRjzZ9U1rkCI9_yxu8koImsbdk-QOEN7t-FLVcap9vSn0Iy_IAk27tG4utp60w_cjR3gUD6AU5L8o
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 May 2023 13:28:48 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 5A00 70 B
264 B 43ms
32ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEK3LXE--uDvnoUb4w2sw8vg&google_cver=1&google_push=ATf1kGMLHCaX8mpJG9FahVMZKpi08Mts1XZcAkurjbiOow0xCT3ZfiDnujLSXcqCzL7GlKTrlxWHIM3EQ72H6QAcNRV6UXfOj4x36_6qP1Ki3q0WCDjtlobGZWonsf5tB9DBNalFO9ltiSs2sfurb-CVjnRUjDM
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A00
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEOnRYWvsSWtg4Nke6dXIeac&google_cver=1&google_push=ATf1kGNNNCTd6atlsEt4PVWsoZ9sir_bIs9o2bH14xGT6EJmzKTEgrjuTCNjeVP-XMzrGkxdq-WAgUof...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEOnRYWvsSWtg4Nke6dXIeac&google_cver=1&google_push=ATf1kGNNNCTd6atlsEt4PVWsoZ9sir_bIs9o2bH14xGT6EJmzKTEgrjuTCNjeVP-XMzrGkxdq-W...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU3NDI5ODUyNDg0MjY0Mjk1Nw&google_push=ATf1kGNNNCTd6atlsEt4PVWsoZ9sir_bIs9o2bH14xGT6EJmzKTEgrjuTCNjeVP-XMzrGkxdq-WAgU...

170 B
188 B

16ms
16ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU3NDI5ODUyNDg0MjY0Mjk1Nw&google_push=ATf1kGNNNCTd6atlsEt4PVWsoZ9sir_bIs9o2bH14xGT6EJmzKTEgrjuTCNjeVP-XMzrGkxdq-WAgUofTdaHK1m9A1XlUoOWcx92_kLxSUBiHFCZidzDWBx6EGcC533Rlbmo8KpivhnfRcFr9edKTHlAph3xSfE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU3NDI5ODUyNDg0MjY0Mjk1Nw&google_push=ATf1kGNNNCTd6atlsEt4PVWsoZ9sir_bIs9o2bH14xGT6EJmzKTEgrjuTCNjeVP-XMzrGkxdq-WAgUofTdaHK1m9A1XlUoOWcx92_kLxSUBiHFCZidzDWBx6EGcC533Rlbmo8KpivhnfRcFr9edKTHlAph3xSfE
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 trk
ag.innovid.com/ Frame 5A00 43 B
296 B 670ms
23ms Image
image/gif 2a05:d01c:1d8:8102:868c:4d80:a08e:dbd6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEP_kUmFHaNCvp8s_LQ-KLvc&google_cver=1&google_push=ATf1kGMUqGbPkdYupZFonC_xmp1yF5on7cSzLB9jE2MEhkX313z2Lu8WsAWh5PXgttYhC0drz90i4acJ-RYN6IaJ_o_TxVfMSL17iKS-COJWTZvxFxtoxEBA-AhZZhDSMwA9A8tVGtaOyfjLiScFH3JKAXjbDN8
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:868c:4d80:a08e:dbd6 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: no-cache
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5A00 0
12 B 27ms
22ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IrzLEkkoVrgvOoMj-EvzGpRBGHWTT0hGsIPDq11Lznl5JfALL3XZIYBgie75KLLPK9G6NF

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 ef33bde3b6f53b5d50fc677805f1b9fa.js Show response
www.gstatic.com/mysidia/ Frame 4972 8 KB
4 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/ef33bde3b6f53b5d50fc677805f1b9fa.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3407508467788263&output=html&h=280&slotname=1579876115&adk=2600020922&adf=2214028041&pi=t.ma~as.1579876115&w=1198&fwrn=4&fwrnh=100&lmt=1685539714&rafmt=1&format=1198x280&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685539727166&bpp=2&bdt=874&idt=203&shv=r20230525&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7716786974829&frm=20&pv=1&ga_vid=1806750341.1685539727&ga_sid=1685539727&ga_hid=546175410&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=381&ady=420&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31074966%2C44788442%2C44789923%2C44789818&oid=2&pvsid=4406493206897173&tmod=1918266381&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=SFVXnMrwIH&p=https%3A//www.visajourney.com&dtd=209

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d42e2b0fdb945504b8da66763e41d57d6245ab8218c6df329b56a841ffbcd7ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 20:41:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60458
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3674
x-xss-protection: 0
last-modified: Mon, 22 May 2023 16:52:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 28 Aug 2023 20:41:10 GMT

GET
H3 200 fd3306c038289a264252f3776a2c4cec.js Show response
www.gstatic.com/mysidia/ Frame 4972 18 KB
7 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/fd3306c038289a264252f3776a2c4cec.js?tag=pingback

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe2637d7a38c7c4563abb83bdfdadf1519f6e1c287a39cb48f75126c6ee2e9f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 29 May 2023 17:30:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 158293
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7616
x-xss-protection: 0
last-modified: Mon, 22 May 2023 16:52:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 27 Aug 2023 17:30:35 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 4972 6 KB
706 B 18ms
17ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 31 May 2023 13:13:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 4972 2 KB
892 B 6ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3ab7853ddfc8ef3468082187bff5636436df85cd9d1e54653530c018cf9d9280

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:00:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66469
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 865
x-xss-protection: 0
server: cafe
etag: 5051423035144352294
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:00:59 GMT

GET
H3 200 136beb7e84d4b05a5b5bba85738ca9f6.js Show response
www.gstatic.com/mysidia/ Frame 4972 6 KB
2 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/136beb7e84d4b05a5b5bba85738ca9f6.js?tag=analytics_pingback_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

220049135e6c242896cea20cbd980419905e04e43cc5d1f9d23db3e00e25c6f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 13:44:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85473
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2330
x-xss-protection: 0
last-modified: Sat, 27 May 2023 00:00:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 28 Aug 2023 13:44:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/ Frame 4972 22 KB
9 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551debe8c4f0db7b25699af72a204caf099af55413f90eb34b5f546330d6187c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 18:49:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67156
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8798
x-xss-protection: 0
server: cafe
etag: 11317101923912129037
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 18:49:32 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 4972 3 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:03:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8743
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 11:03:05 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/ Frame 4972 19 KB
8 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230525/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d47e9b04cf995a35fac50d2d39cd0006ef7e7f07f9373cad2fe5a207745f1b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 19:01:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 66467
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7987
x-xss-protection: 0
server: cafe
etag: 5788035530912182302
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 13 Jun 2023 19:01:01 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4972 0
0 17ms
14ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQlbPgvsg4Xl20nYZmbnnhbNym-Z0mDuRxKdwi1NxOxkLJg7YzHztRLFL0XMwmkXRV3OwiNhQTL3ZL-lZSn4FX8MLwKQQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3407508467788263&output=html&h=280&slotname=1579876115&adk=2600020922&adf=2214028041&pi=t.ma~as.1579876115&w=1198&fwrn=4&fwrnh=100&lmt=1685539714&rafmt=1&format=1198x280&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685539727166&bpp=2&bdt=874&idt=203&shv=r20230525&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7716786974829&frm=20&pv=1&ga_vid=1806750341.1685539727&ga_sid=1685539727&ga_hid=546175410&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=381&ady=420&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31074966%2C44788442%2C44789923%2C44789818&oid=2&pvsid=4406493206897173&tmod=1918266381&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=SFVXnMrwIH&p=https%3A//www.visajourney.com&dtd=209
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4972 171 KB
53 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c3e04a3f536b4a6300aeee8ee1dbbfddaacaf29d9f44dadff76b136fab44e38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54244
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1684927996807358"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 0a0369f67a094afc57e3321b90807283.js Show response
www.gstatic.com/mysidia/ Frame 4972 32 KB
13 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/0a0369f67a094afc57e3321b90807283.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88a51fe784c58c712a93f3f4e123e163e901042438df74cf793bdcf28eb090d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Mon, 29 May 2023 18:00:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 156477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13649
x-xss-protection: 0
last-modified: Sat, 27 May 2023 00:00:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 27 Aug 2023 18:00:51 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FFC6 1 KB
643 B 21ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 10513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 10:33:36 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 10:33:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 15E3 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4900e618d9a208fd037232c7eeb0c0fc1fb5b7b35cadd5d40b46b3c39554415d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 6161
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

19ms
16ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20230525/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:49 GMT
expires: Wed, 31 May 2023 13:28:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:49 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js Show response
pagead2.googlesyndication.com/bg/ Frame FB7D 37 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d53d7da4dd34d0c84942abb930cd555068569f5ad8fdc2ef1024b9a7d975e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:53:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5700
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 11:53:48 GMT

GET
H2 200 montserrat-400.css
static.criteo.net/design/googlefont/montserrat/ Frame 2367 2 KB
803 B 16ms
15ms Stylesheet
text/css 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a81d25118c6f7d835e9ca132b995b8aca46e3575ee4ab2136ab96ac8d5e4688b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 montserrat-700.css
static.criteo.net/design/googlefont/montserrat/ Frame 2367 2 KB
803 B 15ms
14ms Stylesheet
text/css 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-700.css

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

77a44f65bb6894c92e3c7ccab98de0fc357172221cc1dd45949ab938c0c7756a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:55 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7f-675"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/12808310967564234678/ Frame C8A6 15 KB
2 KB 29ms
17ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b54db8bc7924da3e5d14a7e7fa9e5784f733c2a68c5d35cafc2321822a18506d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2269
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:49 GMT
expires: Thu, 30 May 2024 13:28:49 GMT
last-modified: Thu, 16 Feb 2023 16:01:21 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 15E3 0
0 53ms
53ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCMD-1N_Ntg1VugsD4TqBktVRZVApgialWKdlOB4iCF8fBOBYYZ9IAiamT0CIbzmGvcPx7_sZ1S40La4SXq2V8O6PqpDheKaRndpjVDTs1ZhbXOORQE0sif9qR6bj1n1x5i-w1ZnXhGtvnWjRmCct_pbkc4ME9GYptX8DGSKZ4YJ7XJ_QSeuDNzmW7ZntDSHY83G4X2xSgE7z1z59NIOYypPuCVv7_VCoDtmopf4vtW7xGEbOROwgKo3EtqG-HVWjiDNDRAerQnRwGUmA7heN-ccYKhnvO8mQgTwA2CJXg2GbzwLtEoPMdguE5J_wQOQCOHmJR0eMVoId-sGN_eVVsddnVNPCdEeP-HyUdomg3ByiZKPwN1Atse2mJTitgSe1EJbnvfSVvuKIJMPFJN7WEQ1MaWKZ7h3aRuWzej3cYIb6_HYpGTDKVAc6U5IXHIX5rkvT0gEd3jJwvtZknLwKB_YpHlYEXVBAQDaLsufRGFwtNtVd25qpf8jFaPrPkFJkHRUl9RACHddUSJlBkPRWN11sOzIHztWV7sN2zQnCk2Dw9mJg9tYwuzgOMRJbrk_sqcFBpSnmmOliAA2_M_X29F1lTczSmI_cylPKhdrn_Kual5Poy1VJdIqm5SRBiwLHUh-w9sbs4jywb60LzDf5vS5cYXvgTOsTFQ61uCN1fBKiSlbk24ty5qsppokXWQVc0Kwf8O29UWqFo_NFqKlNNI44OmjlywVibkZuXZ0La0hnNyWEePLqJnt_a6SBuYZWo74IIJgqGHXI4h63AJoAGOl4An2BPBmb968nDIZyScMpR7MqI0yl86azPHjk0SYyUDGCGULAFxXjUf2xNSNnIjJz29pJoKexWFby3L9zsYL4kvZqXb7ELYUMDdgCq9RbpHnS6PWGPgnkLbcCJh0LE67JKbW6aALy5ng_5T32S2fHQ7X2y-HcQMzgIo_nWd2lBoiWMGOYn0BQ6joBNOZlc7H47u-DjEW3jZ1V9kIDUIretqW4D_6Dxo2x9FO7CODMT7-4j2O_0ahACCqsGX9P-v6X6FOyWC7HE2lqBmr1_dnFNpQ7EyLUlebFqyGy-Z4YAV-oybemzi4W1m9AVpgmiXLUkhrNCL_e72YhWtYzkalMt9fO7q2t7__8J3u4fRot8BRbh1tYIypVnI0nZICzlFdsaxuVHnf4AGzizNQRION7O9IIBb_20ws5wVBNeR5BwdRHlRhIrs9Y30q2Xcwj4P1q-T0dpz1EAg6UT3tQQZXpQWWS-_uXywUheie7s-CCtoiK2rf9884LTCCa6o2aLY-Inb8ugUT98S0tvze48-vc&sai=AMfl-YQhzYs2JxWF-HpPuftdNJyinDHZybaHt9psryal2dzzPBdAk2yq36nAOBmSdFoylLXsyTbbvycc2UOg-1VgXCdolmGCWT8xaLLIUAEWnVzRcl7VDNu60G0KKs6rbrN23jnKwWcxJxSpR2BCQJl_JXpAtu5dZZd-IbWcTkQF7j_6ko7x0_hRXiSQCogLcNqhAW6uWf0AF-17Ms1d0vhX7_ErzW0D2FpiyTLPDBLQZzxypx6bzxYlrYXAo06Ap1Cw_uZvNSU&sig=Cg0ArKJSzCBPXYYksGmUEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=177&cbvp=1&cstd=168&cisv=r20230525.03487&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 703D 22 KB
8 KB 19ms
8ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 57097
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:37:12 GMT
expires: Wed, 29 May 2024 21:37:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/11613639562295547972/ Frame 4972 6 KB
6 KB 7ms
7ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/11613639562295547972/14763004658117789537?w=400&h=209

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d7df542cf48ef7a214718b0f5b1d137143d0c130e6fa7c6e283c06b9696f7595

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 08:05:52 GMT
x-content-type-options: nosniff
age: 105776
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6092
x-xss-protection: 0
last-modified: Mon, 15 May 2023 16:18:54 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 29 May 2024 08:05:52 GMT

GET
H3 200 14059685884867095393
tpc.googlesyndication.com/simgad/ Frame 4972 2 KB
2 KB 10ms
9ms Image
image/png 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14059685884867095393?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

961277cf4f1b16b06bb079179df474e57920db0e0d7e4ae1acd0ee70a8183595

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 04:27:25 GMT
x-content-type-options: nosniff
age: 32483
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1998
x-xss-protection: 0
last-modified: Fri, 17 Jun 2022 18:16:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 30 May 2024 04:27:25 GMT

GET
H2 200 montserrat-400-latin.woff2
static.criteo.net/design/googlefont/montserrat/ Frame 2367 12 KB
13 KB 48ms
23ms Font
application/octet-stream 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/design/googlefont/montserrat/montserrat-400-latin.woff2

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

5f9376c77618bf0ef43bcabf8228c9e2befde3731087b944e140a88c34066873

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://static.criteo.net/design/googlefont/montserrat/montserrat-400.css
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 08 Dec 2022 14:06:54 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"6391ef7e-31a4"
content-type: text/plain; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 25 May 2024 13:28:48 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4972 0
0 53ms
53ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CEG_rj0t3ZJbpHcmPtwen85v4CrSIwrxwqI6-2NYRnYT-yIAQEAEgwtv8AWCV4pCCoAegAbTorOEDyAEJqAMByAPLBKoEiQJP0Jbv6_jZkZa2h1BsHSEAwlmAOjWZ7mX8ziQxv00g2-uZvJAMAY-Nkggu6ji5LrateMKO_G_jXLiEqDP9oZqS2NkkIA0as5CH-VpsjFHFO_bZwsw9DtDzmkIBNjawqIPvWfJ6FBCepx-QUjcnNKU6jq8CEqPdBy0wvoAEsdJ2XqgYHNQzOFi1YWzCecu48Vki1KgQpRZVTShwkBIzOgJQPFi-LnsDcT5iQeftzO4fpkoV4diYDfWz2gouxHIWhTDs0YVtSG-chH1BPmOyLKAcLoehgPqCD2amCKDPThfuFJG-QOkmV08MEZPC2OmoUKFhp7P-_yVA6YOrZiY2kQxjPtH4cIFKHVg_wATxu7WsiwSSBQQIBBgBkgUECAUYBKAGLoAHtJfTHqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcEEN_9LtIIFgiA4YAQEAEYHzICqgI6AoBASL39wTqACgHICwG4E-QD2BMN0BUBmBYBgBcBshccChoIABIUcHViLTM0MDc1MDg0Njc3ODgyNjMYAA&sigh=1PTOiJDayj8&uach_m=[UACH]&cid=CAQSKQBygQiDBm3hu98yhAi9fxFphje_qe6c-Czfau8moEfvQjitPlmyuKK2GAE&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3407508467788263&output=html&h=280&slotname=1579876115&adk=2600020922&adf=2214028041&pi=t.ma~as.1579876115&w=1198&fwrn=4&fwrnh=100&lmt=1685539714&rafmt=1&format=1198x280&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685539727166&bpp=2&bdt=874&idt=203&shv=r20230525&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7716786974829&frm=20&pv=1&ga_vid=1806750341.1685539727&ga_sid=1685539727&ga_hid=546175410&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=381&ady=420&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31074966%2C44788442%2C44789923%2C44789818&oid=2&pvsid=4406493206897173&tmod=1918266381&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=SFVXnMrwIH&p=https%3A//www.visajourney.com&dtd=209
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9DED 1 KB
643 B 17ms
7ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 10513
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 10:33:36 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 10:33:36 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4972 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e6579fdb3c6f6848c1984dfa545d0102a5c1aeb4659d9ff824357a9016623a7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4972 0
20 B 43ms
42ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/fd3306c038289a264252f3776a2c4cec.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adinit. Show response
fundingchoicesmessages.google.com/f/AGSKWxWnxV_5OswI3QhjmUcgXf-lVcnxhKwl9DYaVJlMBQKvi97yxcD5aNE3CC_AFRs_eukwAFPdXleUlHCkhTklONXfoxs8TAMsWYa_ONEHKEoNVERjLWYQPeKgJqtlOKlU-FUHmmQMoYtL9mFdOMMmUYKN76IkO... 54 B
108 B 22ms
22ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxWnxV_5OswI3QhjmUcgXf-lVcnxhKwl9DYaVJlMBQKvi97yxcD5aNE3CC_AFRs_eukwAFPdXleUlHCkhTklONXfoxs8TAMsWYa_ONEHKEoNVERjLWYQPeKgJqtlOKlU-FUHmmQMoYtL9mFdOMMmUYKN76IkOoTLlAEAeGKdV_ST0s0DQL_Yb4glOW5-/_/x5advcorner./imgad_/thunder/ad.=adimg&impression=/adinit.

Requested by

Host:
URL: /_/mss/boq-content-ads-contributor/_/js/k=boq-content-ads-contributor.ContributorServingResponseClientJs.de.4aynGaqw72E.es5.O/d=1/exm=kernel_loader,loader_js_executable/ed=1/rs=AJlcJMzCVyztqKBk3Vee0ziRMz_pZljxDA/m=ad_blocking_detection_executable

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ebfa8ef5297e61718514c7855bd5e11132c1545172455390497c4cddf539534b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-4rowaU2ZnjBLoD3i9wj1Kw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-4rowaU2ZnjBLoD3i9wj1Kw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 google_top_exp.js Show response
pagead2.googlesyndication.com/pagead/js/ 47 B
67 B 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/google_top_exp.js?fcd=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ccecd185ac16ba0a538840f37701053fbb861f7fbbdd86039c7415fcd924d1f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 12:30:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3505
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
server: cafe
etag: 13036835877489095579
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 12:30:24 GMT

POST
H3 204 AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 23ms
23ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-J8LThlDdpRf4aCluHptLQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-J8LThlDdpRf4aCluHptLQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.visajourney.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1676550659977.css
s0.2mdn.net/sadbundle/12808310967564234678/ Frame C8A6 9 KB
2 KB 14ms
13ms Stylesheet
text/css 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b3dae2cc3eb0b05c0bc83751d8ac28cfe95fb500beab267028c8af691946ed8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 21:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 315933
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2430
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:01:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 21:43:16 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame C8A6 118 KB
40 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 10:36:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10347
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Jun 2023 10:36:22 GMT

GET
H3 200 1676550659977.js Show response
s0.2mdn.net/sadbundle/12808310967564234678/ Frame C8A6 20 KB
5 KB 15ms
14ms Script
application/x-javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cff8001763a4cb0cb81352e07fb9927790673baaeda29140c072f30c5933cf10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 21:43:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 315933
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5491
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:01:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 21:43:16 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame FFC6 0
104 B 373ms
24ms Image
text/plain 89.207.16.140
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEOJuzClqsJ8h8HEUSBeER1s&google_cver=1&google_push=ATf1kGPjplYqq7aEJd29fCYQEWp7FkesLkF0kc8MhQ2xWhwTNLcpjNvdgFjIjR_1EPY57VEo6kyNGj7h534IIgLb6E_U9EywkTPWupg
Requested by: Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 89.207.16.140 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE, US),
Reverse DNS: ams03-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFC6
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGzgEX6OI29dnjOFGzD1-rQ&google_push=ATf1kGOoIbFThW50WgTiBqFOdHFVsgqJLubs3BCrWu5G4Fr579qJWjeRsi...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGzgEX6OI29dnjOFGzD1-rQ&google_push=ATf1kGOoIbFThW50WgTiBqFOdHFVsgqJLubs3BCrWu5G4Fr579qJWjeRsixKwkS4iZaz1_gH_rLQ2NCrz6q-UY7HxNZmMFhE5G452U8

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230062-FRA
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1685539729.356135,VS0,VE185
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEGzgEX6OI29dnjOFGzD1-rQ&google_push=ATf1kGOoIbFThW50WgTiBqFOdHFVsgqJLubs3BCrWu5G4Fr579qJWjeRsixKwkS4iZaz1_gH_rLQ2NCrz6q-UY7HxNZmMFhE5G452U8
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame FFC6 70 B
264 B 37ms
28ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEFqfn5kNlgCJO1s4WeVp_oo&google_cver=1&google_push=ATf1kGOeXJ2v4EI0QmIsGOriJ2XjLWn9yA5oLycZFqHJRDw8RzsowC4sacay1UFXqdyu6ruOUZSxOX1aZimRh7DDNP7eMeCHQyhV0iM
Requested by: Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFC6
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEO-5K_cj37mRO8qNP23i77M&google_cver=1&google_push=ATf1kGMowMTHWUbb2fPwKD2pDaXMcHHQawly4LtDZLNucx6l7yDD--9zb91ICSyQ-GqNy7H9jKuuwB9ZMTGdWL...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTMzODAxMjE3NTQzMTgyMw%3D%3D&google_push=ATf1kGMowMTHWUbb2fPwKD2pDaXMcHHQawly4LtDZLNucx6l7yDD--9zb91ICSyQ-GqNy7H9jKuuwB9ZMTGdWLB8Mx...

170 B
188 B

21ms
20ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTMzODAxMjE3NTQzMTgyMw%3D%3D&google_push=ATf1kGMowMTHWUbb2fPwKD2pDaXMcHHQawly4LtDZLNucx6l7yDD--9zb91ICSyQ-GqNy7H9jKuuwB9ZMTGdWLB8MxV3LveYqcn3J1Y

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTMzODAxMjE3NTQzMTgyMw%3D%3D&google_push=ATf1kGMowMTHWUbb2fPwKD2pDaXMcHHQawly4LtDZLNucx6l7yDD--9zb91ICSyQ-GqNy7H9jKuuwB9ZMTGdWLB8MxV3LveYqcn3J1Y
Date: Wed, 31 May 2023 13:28:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFC6
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmSOOqIS0_Fa6iBBlNc4Bg&google_cver=1&google_push=ATf1kGMIr0Vpr0nRSyeZjWMpOlQq3YQtMsEz2Y9tZrPvK3MvzfG828AAh6KYjsfmlTviqYtVIdBPtz7_DXroBDt2ZJD0uVv...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMIr0Vpr0nRSyeZjWMpOlQq3YQtMsEz2Y9tZrPvK3MvzfG828AAh6KYjsfmlTviqYtVIdBPtz7_DXroBDt2ZJD0uVv7fmd69TY&google_hm=eS1hX25md1FoRTJwRVh...

170 B
188 B

22ms
21ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMIr0Vpr0nRSyeZjWMpOlQq3YQtMsEz2Y9tZrPvK3MvzfG828AAh6KYjsfmlTviqYtVIdBPtz7_DXroBDt2ZJD0uVv7fmd69TY&google_hm=eS1hX25md1FoRTJwRVhieWw2dHZ1dWtMM05CNFk3bl9PNX5B

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:49 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMIr0Vpr0nRSyeZjWMpOlQq3YQtMsEz2Y9tZrPvK3MvzfG828AAh6KYjsfmlTviqYtVIdBPtz7_DXroBDt2ZJD0uVv7fmd69TY&google_hm=eS1hX25md1FoRTJwRVhieWw2dHZ1dWtMM05CNFk3bl9PNX5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FFC6
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESED1-uRDBroXKhyjRF0QH4JM&google_cver=1&google_push=ATf1kGN1R_qPbN4j3iStABs-RLC3mmb21L4rSDoPigShP07O6ERK1SAeb9xp4hWUVuocLuBORvC-sg7C...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU3NDI5ODUyNDg0MjY0Mjk1Nw&google_push=ATf1kGN1R_qPbN4j3iStABs-RLC3mmb21L4rSDoPigShP07O6ERK1SAeb9xp4hWUVuocLuBORvC-sg...

170 B
188 B

21ms
21ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU3NDI5ODUyNDg0MjY0Mjk1Nw&google_push=ATf1kGN1R_qPbN4j3iStABs-RLC3mmb21L4rSDoPigShP07O6ERK1SAeb9xp4hWUVuocLuBORvC-sg7C613b8ULR8jaZ4l7uTdmgAXU

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTU3NDI5ODUyNDg0MjY0Mjk1Nw&google_push=ATf1kGN1R_qPbN4j3iStABs-RLC3mmb21L4rSDoPigShP07O6ERK1SAeb9xp4hWUVuocLuBORvC-sg7C613b8ULR8jaZ4l7uTdmgAXU
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

report
sync.teads.tv/um/ Frame FFC6
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEML87v62WycwrCpHfgOLDC0&...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=ATf1kGOkA_XgxvtzZpm71tVj0AeqgZKkOCQE9QfhB2xKbiod3Ur9SSGjI2XtfXNkzlB-5tY_jtwdxa40z70WZkzG1pNDGbi7uATQezx2
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

38ms
38ms

Image
image/gif

104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

expires: Wed, 31 May 2023 13:28:49 GMT
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame FFC6 0
12 B 19ms
15ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ily6xyu61josR7aGhIrhWcVX4i6ElddNzB0JT8f8aomX1mNAM30yhPepGGUm4rWPJ54cwTbw

Requested by

Host: 0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com
URL: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9DED
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKtYNauLJYQuwHwkhYUNVDQ&google_cver=1&google_push=ATf1kGNfU1nQVCVzrH48SZ53hFLYLkTT6yyPbqXDMhqOwvsNDUhk-aME9N...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNfU1nQVCVzrH48SZ53hFLYLkTT6yyPbqXDMhqOwvsNDUhk-aME9NDMtl6QKv5FSoRg3YiSi3N_uf3SHcTWGjWpZxf6BupLygM&google_hm=z_JyxI5Wx...

170 B
188 B

22ms
21ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNfU1nQVCVzrH48SZ53hFLYLkTT6yyPbqXDMhqOwvsNDUhk-aME9NDMtl6QKv5FSoRg3YiSi3N_uf3SHcTWGjWpZxf6BupLygM&google_hm=z_JyxI5WxMqO5FEazsBhPQ

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNfU1nQVCVzrH48SZ53hFLYLkTT6yyPbqXDMhqOwvsNDUhk-aME9NDMtl6QKv5FSoRg3YiSi3N_uf3SHcTWGjWpZxf6BupLygM&google_hm=z_JyxI5WxMqO5FEazsBhPQ
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9DED
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEOD04eyHW119H9M3GpxBzRY&google_cver=1&google_push=ATf1kGPAFk2t8hT6QosB7LjXDZUZA8Z14BtGQzrPZeaLr63oOARY53L61r3XJRrORdepp-ftdlaltRnTXf3EaRwi...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=QeNkd0uRQQCx-QE5JRozNA&google_push=ATf1kGPAFk2t8hT6QosB7LjXDZUZA8Z14BtGQzrPZeaLr63oOARY53L61r3XJRrORdepp-ftdlaltRnTXf3EaRwi0xv_yqiA...

170 B
188 B

19ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=QeNkd0uRQQCx-QE5JRozNA&google_push=ATf1kGPAFk2t8hT6QosB7LjXDZUZA8Z14BtGQzrPZeaLr63oOARY53L61r3XJRrORdepp-ftdlaltRnTXf3EaRwi0xv_yqiAyPw-xg

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 31 May 2023 13:28:49 GMT
Server: MT3 851 9bd98ae master zrh-pixel-x30 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=QeNkd0uRQQCx-QE5JRozNA&google_push=ATf1kGPAFk2t8hT6QosB7LjXDZUZA8Z14BtGQzrPZeaLr63oOARY53L61r3XJRrORdepp-ftdlaltRnTXf3EaRwi0xv_yqiAyPw-xg
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 31 May 2023 13:28:48 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9DED
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESENnu_LMNWzr7AljgWKfADRs&google_push=ATf1kGPSwQkwGCh1qMt-IHwi6owzXGn9uIwcU3fUXR8aQc_v1dAoLZiS5N...

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESENnu_LMNWzr7AljgWKfADRs&google_push=ATf1kGPSwQkwGCh1qMt-IHwi6owzXGn9uIwcU3fUXR8aQc_v1dAoLZiS5NKv-YFtkzlTvRGto2yvzzYMtqVQ5MrfJ0BcJ9B-NLp_y58

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230062-FRA
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1685539729.374799,VS0,VE89
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESENnu_LMNWzr7AljgWKfADRs&google_push=ATf1kGPSwQkwGCh1qMt-IHwi6owzXGn9uIwcU3fUXR8aQc_v1dAoLZiS5NKv-YFtkzlTvRGto2yvzzYMtqVQ5MrfJ0BcJ9B-NLp_y58
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 9DED 0
173 B 38ms
14ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEKf1HZKAggu1Tpp6_K2LrkI&google_cver=1&google_push=ATf1kGM2SxBx8Egctxx3dKu3u3y1U4JdHYhnuULtivDJmPRG72KBcfPjwUcnj6dIJxq_tAuSTOeOnKHB_R-8aHep03yOr3rC2cpRdM0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3407508467788263&output=html&h=280&slotname=1579876115&adk=2600020922&adf=2214028041&pi=t.ma~as.1579876115&w=1198&fwrn=4&fwrnh=100&lmt=1685539714&rafmt=1&format=1198x280&url=https%3A%2F%2Fwww.visajourney.com%2Fprofile%2F450076-nflow3%2F%3Ftab%3Dfield_core_pfield_19&fwr=0&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1685539727166&bpp=2&bdt=874&idt=203&shv=r20230525&mjsv=m202305250101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7716786974829&frm=20&pv=1&ga_vid=1806750341.1685539727&ga_sid=1685539727&ga_hid=546175410&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=381&ady=420&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C31074966%2C44788442%2C44789923%2C44789818&oid=2&pvsid=4406493206897173&tmod=1918266381&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=SFVXnMrwIH&p=https%3A//www.visajourney.com&dtd=209
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9DED
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEBtSQ40R496dlyewOdfQWjg&google_cver=1&google_push=ATf1kGO9y3RuQ3-daVsmAGUsvpddBYki8wbwR1dzm21D4LwhTjf-JnARu7PmzYQavDkqb2c0TFRCr-aj7n99yHprIl3wwEh...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGO9y3RuQ3-daVsmAGUsvpddBYki8wbwR1dzm21D4LwhTjf-JnARu7PmzYQavDkqb2c0TFRCr-aj7n99yHprIl3wwEhz6VYGBg&google_hm=eS1hX25md1FoRTJwRVhi...

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGO9y3RuQ3-daVsmAGUsvpddBYki8wbwR1dzm21D4LwhTjf-JnARu7PmzYQavDkqb2c0TFRCr-aj7n99yHprIl3wwEhz6VYGBg&google_hm=eS1hX25md1FoRTJwRVhieWw2dHZ1dWtMM05CNFk3bl9PNX5B

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:49 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGO9y3RuQ3-daVsmAGUsvpddBYki8wbwR1dzm21D4LwhTjf-JnARu7PmzYQavDkqb2c0TFRCr-aj7n99yHprIl3wwEhz6VYGBg&google_hm=eS1hX25md1FoRTJwRVhieWw2dHZ1dWtMM05CNFk3bl9PNX5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 9DED 43 B
363 B 44ms
14ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESEK05m-IUm3N7YDWud7KYpIU&google_cver=1&google_push=ATf1kGNqSWSB6Z1bKll4QPb7K-MM6AGRL3zv5x2-IBFDPZpos076i7CJreYmGsQtJ6jKOGcrojYXLsQS1g4zBb8CBauc_KmGgh7Ervc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:48 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 278224
expires: Wed, 31 May 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9DED
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESED3ykWDsP8pQ0zd7DKZYVf0&google_cver=1&google_push=ATf1kGMgjN-6wS1z0RqkT511jWbgcRCangGrelqSYCC0RMElOmLCqCHwvgpOl3Xt5NbfGgBPLDv-0M3g6HoT...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMgjN-6wS1z0RqkT511jWbgcRCangGrelqSYCC0RMElOmLCqCHwvgpOl3Xt5NbfGgBPLDv-0M3g6HoTxE7rvwW3Q2Hu6Vu645I

170 B
188 B

17ms
17ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMgjN-6wS1z0RqkT511jWbgcRCangGrelqSYCC0RMElOmLCqCHwvgpOl3Xt5NbfGgBPLDv-0M3g6HoTxE7rvwW3Q2Hu6Vu645I

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMgjN-6wS1z0RqkT511jWbgcRCangGrelqSYCC0RMElOmLCqCHwvgpOl3Xt5NbfGgBPLDv-0M3g6HoTxE7rvwW3Q2Hu6Vu645I
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9DED 0
12 B 15ms
14ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ItYqYek87oa9o2pVc0etQHnZolGtLx1TxOWy49SHIGxAUsO2MF5zsenMlneewmI2jPoHZx

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 20ms
20ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kEBk5inZJ45nTpH8-t4M2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-kEBk5inZJ45nTpH8-t4M2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.visajourney.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js Show response
pagead2.googlesyndication.com/bg/ Frame 703D 37 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d53d7da4dd34d0c84942abb930cd555068569f5ad8fdc2ef1024b9a7d975e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:53:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 11:53:48 GMT

POST
H3 204 AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 41ms
40ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Lr8YcpzQ9aH-cyn1g1Pvhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-Lr8YcpzQ9aH-cyn1g1Pvhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.visajourney.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 55ms
55ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxWVg42UbEK5mXTJALdlpn-hQpbHHN9CUEOCllUGho__tXhqcjHjcuXfxT_IFWPs9A7eeatCHiSwIBxj6yE8pBCCmTIoKAsAeLpwF2k7-g9ZIXXTfnfwnr5-kqBdyYbXzLIIcp8XMg==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EpWuM-pDmfprFD8aCtgI6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-EpWuM-pDmfprFD8aCtgI6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
access-control-max-age: 86400
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-type: text/html; charset=utf-8
access-control-allow-origin: https://www.visajourney.com
access-control-allow-methods: POST, GET, OPTIONS
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 AGSKWxX7_UgO_Sxjze2Q4GvXmGK0DV5J-VcSD88PAlD6lSHcUy0s-WcNP2Vrmgw7TMqOZbLik2ghGMGfXzPBnqqhJT87Mr-Yd9sOrOJpTf0azOb2vekPuUDeyRxrezS_y7adSK3v_K6sjQ== Show response
fundingchoicesmessages.google.com/f/ 3 KB
2 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/f/AGSKWxX7_UgO_Sxjze2Q4GvXmGK0DV5J-VcSD88PAlD6lSHcUy0s-WcNP2Vrmgw7TMqOZbLik2ghGMGfXzPBnqqhJT87Mr-Yd9sOrOJpTf0azOb2vekPuUDeyRxrezS_y7adSK3v_K6sjQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNjg1NTM5NzI5LDQwOTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsNl0sbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsMV0sImh0dHBzOi8vd3d3LnZpc2Fqb3VybmV5LmNvbS9wcm9maWxlLzQ1MDA3Ni1uZmxvdzMvIixudWxsLFtbOCwiNGF5bkdhcXc3MkUiXSxbOSwiZGUiXSxbMTYsIlsxLDEsMV0iXSxbMTcsIlswXSJdXV0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7771f936a65df1c7ab556575430f99427f176001718514ff2cc643e886657a26

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-WTzp74C2Xua7pZmevIt8Vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-WTzp74C2Xua7pZmevIt8Vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
timing-allow-origin: *
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js Show response
pagead2.googlesyndication.com/bg/ Frame 790D 37 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d53d7da4dd34d0c84942abb930cd555068569f5ad8fdc2ef1024b9a7d975e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:53:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 11:53:48 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 4972 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Fri, 26 May 2023 23:14:12 GMT
x-content-type-options: nosniff
age: 396877
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 25 May 2024 23:14:12 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 4972 15 KB
16 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:10:14 GMT
x-content-type-options: nosniff
age: 76715
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 16:10:14 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 4972 15 KB
15 KB 9ms
9ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 22:48:48 GMT
x-content-type-options: nosniff
age: 52801
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 22:48:48 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/12808310967564234678/ Frame C8A6 3 KB
1 KB 9ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12808310967564234678/logo.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f88ad1b185e443ce4a39c76c65fa4b6f199c1521398535cc5452b19304d5f17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 27 May 2023 23:15:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 310392
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1359
x-xss-protection: 0
last-modified: Thu, 16 Feb 2023 16:01:21 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 23:15:37 GMT

POST
H3 204 AGSKWxXXOHpsNea5SUeraIy0Q2dfku9vbCTl3TaRiYxEzT0PnatR1jwZx-Bns3M8Gz2s0y64q23A1lMReIV5YjlshBtvcOFCvKnFUv8R8s-RlCRjFnG9vvo76YqYnn7_ryv_F1_FNe7ekA== Show response
fundingchoicesmessages.google.com/el/ 0
28 B 20ms
20ms XHR
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fundingchoicesmessages.google.com/el/AGSKWxXXOHpsNea5SUeraIy0Q2dfku9vbCTl3TaRiYxEzT0PnatR1jwZx-Bns3M8Gz2s0y64q23A1lMReIV5YjlshBtvcOFCvKnFUv8R8s-RlCRjFnG9vvo76YqYnn7_ryv_F1_FNe7ekA==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-gGDFfqELfgolHj4I-lyV6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-security-policy: require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-gGDFfqELfgolHj4I-lyV6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: same-origin
server: ESF
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-max-age: 86400
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://www.visajourney.com
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
x-frame-options: SAMEORIGIN
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 15E3 0
0 45ms
45ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCMD-1N_Ntg1VugsD4TqBktVRZVApgialWKdlOB4iCF8fBOBYYZ9IAiamT0CIbzmGvcPx7_sZ1S40La4SXq2V8O6PqpDheKaRndpjVDTs1ZhbXOORQE0sif9qR6bj1n1x5i-w1ZnXhGtvnWjRmCct_pbkc4ME9GYptX8DGSKZ4YJ7XJ_QSeuDNzmW7ZntDSHY83G4X2xSgE7z1z59NIOYypPuCVv7_VCoDtmopf4vtW7xGEbOROwgKo3EtqG-HVWjiDNDRAerQnRwGUmA7heN-ccYKhnvO8mQgTwA2CJXg2GbzwLtEoPMdguE5J_wQOQCOHmJR0eMVoId-sGN_eVVsddnVNPCdEeP-HyUdomg3ByiZKPwN1Atse2mJTitgSe1EJbnvfSVvuKIJMPFJN7WEQ1MaWKZ7h3aRuWzej3cYIb6_HYpGTDKVAc6U5IXHIX5rkvT0gEd3jJwvtZknLwKB_YpHlYEXVBAQDaLsufRGFwtNtVd25qpf8jFaPrPkFJkHRUl9RACHddUSJlBkPRWN11sOzIHztWV7sN2zQnCk2Dw9mJg9tYwuzgOMRJbrk_sqcFBpSnmmOliAA2_M_X29F1lTczSmI_cylPKhdrn_Kual5Poy1VJdIqm5SRBiwLHUh-w9sbs4jywb60LzDf5vS5cYXvgTOsTFQ61uCN1fBKiSlbk24ty5qsppokXWQVc0Kwf8O29UWqFo_NFqKlNNI44OmjlywVibkZuXZ0La0hnNyWEePLqJnt_a6SBuYZWo74IIJgqGHXI4h63AJoAGOl4An2BPBmb968nDIZyScMpR7MqI0yl86azPHjk0SYyUDGCGULAFxXjUf2xNSNnIjJz29pJoKexWFby3L9zsYL4kvZqXb7ELYUMDdgCq9RbpHnS6PWGPgnkLbcCJh0LE67JKbW6aALy5ng_5T32S2fHQ7X2y-HcQMzgIo_nWd2lBoiWMGOYn0BQ6joBNOZlc7H47u-DjEW3jZ1V9kIDUIretqW4D_6Dxo2x9FO7CODMT7-4j2O_0ahACCqsGX9P-v6X6FOyWC7HE2lqBmr1_dnFNpQ7EyLUlebFqyGy-Z4YAV-oybemzi4W1m9AVpgmiXLUkhrNCL_e72YhWtYzkalMt9fO7q2t7__8J3u4fRot8BRbh1tYIypVnI0nZICzlFdsaxuVHnf4AGzizNQRION7O9IIBb_20ws5wVBNeR5BwdRHlRhIrs9Y30q2Xcwj4P1q-T0dpz1EAg6UT3tQQZXpQWWS-_uXywUheie7s-CCtoiK2rf9884LTCCa6o2aLY-Inb8ugUT98S0tvze48-vc&sai=AMfl-YQhzYs2JxWF-HpPuftdNJyinDHZybaHt9psryal2dzzPBdAk2yq36nAOBmSdFoylLXsyTbbvycc2UOg-1VgXCdolmGCWT8xaLLIUAEWnVzRcl7VDNu60G0KKs6rbrN23jnKwWcxJxSpR2BCQJl_JXpAtu5dZZd-IbWcTkQF7j_6ko7x0_hRXiSQCogLcNqhAW6uWf0AF-17Ms1d0vhX7_ErzW0D2FpiyTLPDBLQZzxypx6bzxYlrYXAo06Ap1Cw_uZvNSU&sig=Cg0ArKJSzCBPXYYksGmUEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=955&vt=11&dtpt=778&dett=3&cstd=168&cisv=r20230525.03487&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: www.visajourney.com
URL: https://www.visajourney.com/profile/450076-nflow3/?tab=field_core_pfield_19

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-212-88-20.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 31 May 2023 13:28:49 GMT

GET
H2 200 checksync.php Show response
hbx.media.net/ Frame C843 30 KB
10 KB 28ms
28ms Document
text/html 23.212.88.20
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://hbx.media.net/checksync.php?cid=8CU2CYR88&cs=1&cv=37&hb=1&prvid=255%2C3016%2C76%2C229%2C117%2C28%2C172%2C77%2C226%2C2033%2C459%2C102%2C3015%2C225%2C307%2C97%2C244%2C178%2C184%2C141%2C193%2C159%2C236%2C182%2C80%2C51%2C2022%2C145%2C186%2C251%2C214%2C33%2C188%2C109%2C246%2C122%2C175%2C208%2C3018%2C38%2C3014%2C108%2C233%2C201%2C3017%2C70%2C2034%2C273%2C237%2C3008%2C461%2C157%2C55%2C3012%2C262%2C222%2C3007%2C203&vsSync=1&refUrl=&gdpr=1&gdprconsent=2&gdprstring=&usp_status=0&usp_consent=1&coppa=0

Requested by

Host: hbx.media.net
URL: https://hbx.media.net/bidexchange.js?cid=8CU2CYR88&dn=www.visajourney.com&https=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.212.88.20 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e72bdaa00aaf327a0b5149355b60364c0573e8612ffe4f1c59dab77c7716febe

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains max-age=604800

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 10276
content-type: text/html; charset=UTF-8
date: Wed, 31 May 2023 13:28:49 GMT
expires: Fri, 02 Jun 2023 13:28:49 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=86400 ; includeSubDomains max-age=604800
vary: Accept-Encoding
x-mnet-hl2: E

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 70ms
56ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230525&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7aca7c22742bdd5132dba59a305d441ebf1f4e012f3870396ca3a3b8463d581f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11267
x-xss-protection: 0

GET
H3 200 1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js Show response
pagead2.googlesyndication.com/bg/ Frame 62DF 37 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d53d7da4dd34d0c84942abb930cd555068569f5ad8fdc2ef1024b9a7d975e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:53:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 11:53:48 GMT

GET
H2 200 webfont.js Show response
ajax.googleapis.com/ajax/libs/webfont/1/ Frame C8A6 13 KB
6 KB 68ms
6ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81016ac6be850b72df5d4faa0c3cec8e2c1b0ba0045712144a6766adfad40bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Thu, 25 May 2023 20:00:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 494906
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5437
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 May 2024 20:00:23 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C8A6 7 KB
6 KB 58ms
58ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d47e13fe207ee25f0a1533872709598666a03401b675c5de67bbfa1b3dffc70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5772
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4651 42 B
64 B 53ms
53ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstsJTkYzVmaTNFNo86hw2Y_pYcs-mnh-NGRwb4tFwCoZtSWUUUhJmrFIuEVojBJwtNM-XFfSTG_I7DXP7j1ZAEy5mxeXWLdB4TaIidD5rJXsa8Ih_KoMldqa3KWlTVhzs_6tc0h6g&sai=AMfl-YTzXth4HKkWDgs8t7zUPH7gLaLQgULc-HwU9wUAXpVHo0pjxawVplxgQ5vVMrVck0htF06xdWcYjcN2FWTc2R-r7MxXGB2MNlNxgyEyDoAf1hti36hv97XfyMAT&sig=Cg0ArKJSzKvLDnpsnjphEAE&cid=CAQSPABygQiDK6JitLTFtWaNhpqNVhIeVfjRDT00EFSnMS6bRkgcdouPTZndccBTZAx-mrN4PEM23K74utEulRgB&id=lidar2&mcvt=1099&p=877,51,1127,351&mtos=1099,1099,1099,1099,1099&tos=1099,0,0,0,0&v=20230524&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1528070754&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685539728114&rpt=382&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4972 0
20 B 45ms
45ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=mys&d=Cg4IByoKd2ViX2Jhbm5lcgoHCAgqA2x0cgoLCAEqB2Jhbm5lckIKCggCKgZzZXJ2ZXIKFQgEKhFteXNpZGlhX2FuYWx5dGljcwoNEBAhAAAAAKCX4kAwBAoNEBEhAAAAAGA48kAwBAoNEBIhAAAAAAAAIEAwBAoNEBMhAAAAAAAACEAwBAoNEBchAAAAAAD6n0AwBAoNEBQhAAAAAMDg9EAwBAoNEBUhAAAAAAAALkAwBAoNEBYhAAAAAAAAFEAwBAoNEBghAABgZmaSoEAwBAoNEDIhAAAAZGaGVEAwBAoNEDMhAAAAZGaGVEAwBAoNEDQhAAAAZGaGVEAwBAoNEDUhAAAAZGaGVEAwBAoNEDYhAAAAZGaGVEAwBAoNEDchAAAAZGaGVEAwBAoNEDghAAAAAABAVUAwBAoNEDkhAAAAAAAGk0AwBAoNEDohAABAMzMjk0AwBAoNEDshAADAzMzyn0AwBAoNEDwhAADAzMzyn0AwBAoNED0hAAAAAAD6n0AwBAoNED4hAACgmZmAoEAwBAoNED8hAACgmZmAoEAwBAoNEEAhAAAAAACaoEAwBBIaQ05iczJPWFVuXzhDRmNuSDdRb2RwX2tHcnciHHNjcmVhbS90aHJvbmVfaW1hZ2VfbG9nb19vY2goEQ==

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/mysidia/fd3306c038289a264252f3776a2c4cec.js?tag=pingback

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 31 May 2023 13:28:49 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C8A6 17 KB
6 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 31 May 2023 13:28:49 GMT

GET
H2 200 log
c21lg-d.media.net/ Frame C843 35 B
164 B 217ms
201ms Image
image/gif 23.35.228.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c21lg-d.media.net/log?logid=kfk&evtid=cs&del=1&vsid=3285413298890004000V10&origin=1&flt=0&pvgid[]=data-p&pvgid[]=data-b&pvgid[]=data-t&pvgid[]=data-sov&pvgid[]=data-r1&pvgid[]=data-pb&pvgid[]=data-xu&pvgid[]=data-tx&pvgid[]=data-bs&pvgid[]=data-c&pvgid[]=data-ct
Requested by: Host: hbx.media.net
URL: https://hbx.media.net/checksync.php?cid=8CU2CYR88&cs=1&cv=37&hb=1&prvid=255%2C3016%2C76%2C229%2C117%2C28%2C172%2C77%2C226%2C2033%2C459%2C102%2C3015%2C225%2C307%2C97%2C244%2C178%2C184%2C141%2C193%2C159%2C236%2C182%2C80%2C51%2C2022%2C145%2C186%2C251%2C214%2C33%2C188%2C109%2C246%2C122%2C175%2C208%2C3018%2C38%2C3014%2C108%2C233%2C201%2C3017%2C70%2C2034%2C273%2C237%2C3008%2C461%2C157%2C55%2C3012%2C262%2C222%2C3007%2C203&vsSync=1&refUrl=&gdpr=1&gdprconsent=2&gdprstring=&usp_status=0&usp_consent=1&coppa=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.35.228.23 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-228-23.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hbx.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: max-age=0, no-cache, no-store
expires: Wed, 31 May 2023 13:28:49 GMT
content-length: 35
content-type: image/gif

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FB7D 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BtOphkEt3ZKbiE6qQjuwP9feN8AwAAAAAOAHgBAI&bg=!X1ylXAjNAAZu7ficTu07ADkAdvg8WjyN8byDnpkD42DT-Al_5S3N9G17oFRq3hNdgBl-CHyH6ByNN1sZXKAIg_TeZIeJ6kljRX0CAAABllIAAAADaAEHmQL-VBK1ziPKgLcyojSN3HdtI2604JfIeUqQGzkm_x5qcvyMUgZhxDIiGlpQeqyMH8NsWHl-G5_uUaIc7EfED3Hpt0aq3mLxlQEObRTk81F7goXwIkE5YY93Y7tAfJE1Z_veVpmNDB-pNEmZFjff6S2IoCvoCbhOVS216JR1Zt6Csi9k9QzkSFltXCCq9TQs5xpXL-13PGT6Yzar2Y4jr3sx-7ognQvLBQtGZZ0JgNzkdtgVewPNw8dQbxgLmhfLnZwlkrc1dp9rFanS_arHyVIP0RozkmnMasbNWmPS33ddJEpFh8IDvcH6Ikp3ViVQTio37Rc1wompVxWVaFt6F_WreLR5IEWPJb01xr5F4RPMHqY4uQdVCVvQE-JLwnXGj8oEY7hj_IrtbvMAvGbikm9KV8Xne8KqDgFZZWx9ueNUl2XrkxkdIwZWeEqPHLnyUB4c3JmKQGOvQdRQmbmippF3ykUamGBCRdm_yE5ltpLf3ZLyEqDJ91Z-OF4J0unBddjC11dD9qWLocmR_PWh0qOuKLJWAh7IL82naCPP2Yslokk62l_R2eafLjZe2KbtwDLY7bO2gCtvrBEWXQ0ihf-WkPisbR8UXVwqwRr5xmIcK09IoeK1QA3RvFxtwDKGQUg37YyI57dNPNLXzb2UxRDeVQO3CfTBKuidKe79pKtoThDow8H2ZL60iWwE7SVrPqjpzOEMp1Ff_ZdBiZOnVKQrQ4-Dlnr0Dfi0PLy7F6VybRkOoA9b9-hgAs4dRlOM6XGzZuPWUhP8dYSMrBR_qivsEQSold43RA1p7H--NiK3aaFuo2Qg92yLAxIfdRZB4GpBcm2-B9rehLyTVWROl47ptW9a9plduM5FMq0doNjYSQYKldLHWUi668J8sa1zFi5eW7fnHA8JqFVJ2chrV5MtQeK2l0w9dzYikJX7nAaAQ7zJmv-r22Xwb9VBudjtxmXtd-WN0ALJJk4neGPe_4SrbnUZVo0R8va1dcHAWhvi7WvOOO_HvzINPol1BszASg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4651 0
20 B 43ms
42ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8624099347154&version=m202301230201&ct=76&x=1&cor=16000164824485085000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 15E3 42 B
64 B 50ms
49ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss8tPWpuOmKnHJdBkLgcPZ37GyZraX-SHNyJhqHq8-F7D-HXy6XRRjf2GqD0pT3dx0n0nIo48xjGkCKhBQ4Hg5tPkiMHQ9uReEmuDQTAqKmGTdxhbNXcp8SvPLn9dx7-ot_hIWYhA&sai=AMfl-YTS6uIpji-5F8GcWhc_IKaTvH406vRIb0fX1bQxVuLI5gcajXjd4DHrYhvoVn3PHOtYkm8Vm5fpOqqooV6JofEBu7cXX70LNbNYLQ5mQy9xVaFT5lV2ymAhIrrm&sig=Cg0ArKJSzPSvKwsYH1XUEAE&cid=CAQSPABygQiDK6JitLTFtWaNhpqNVhIeVfjRDT00EFSnMS6bRkgcdouPTZndccBTZAx-mrN4PEM23K74utEulRgB&id=lidar2&mcvt=1103&p=543,41,643,361&mtos=1103,1103,1103,1103,1103&tos=1103,0,0,0,0&v=20230524&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2974337371&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685539728125&rpt=579&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CCC4 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss8RqQP81Ii840pY0GRFA5iPN8PxO1r0GqUad2qDK_g_FHYa_z76J5V5dWHsbvSq0KbAIquIcMGR6F_hV3J4LmyX0vM&sig=Cg0ArKJSzDTnepbU7OleEAE&id=lidar2&mcvt=1083&p=0,0,124,1005&mtos=170,880,1083,1105,1268&tos=170,710,203,22,163&v=20230524&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685539728332&rpt=220&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 2367 0
127 B 14ms
14ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 31 May 2023 13:28:49 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 congstarfont.woff2
s0.2mdn.net/creatives/assets/4234010/ Frame C8A6 98 KB
98 KB 10ms
10ms Font
font/woff2 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4234010/congstarfont.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d019867c120344469403527c7d958861b81d0fc873813c97ee135f707d74122

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:22:14 GMT
x-content-type-options: nosniff
age: 395
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100772
x-xss-protection: 0
last-modified: Thu, 05 Aug 2021 09:13:07 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 31 May 2023 13:37:14 GMT

GET
H3 200 86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff
s0.2mdn.net/creatives/assets/1881029/ Frame C8A6 57 KB
57 KB 11ms
11ms Font
font/woff 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/1881029/86bef0b5-fa75-4ca3-8394-cb7b5a474a45-3.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

853a8c7e34be5549a44fc541e13876f5c2838123142f527dab2265950feaeefb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/1676550659977.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:17:20 GMT
x-content-type-options: nosniff
age: 689
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58447
x-xss-protection: 0
last-modified: Wed, 15 Feb 2017 10:23:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 31 May 2023 13:32:20 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 74D8 13 KB
5 KB 8ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 8732
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 11:03:17 GMT
expires: Thu, 30 May 2024 11:03:17 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6636 783 B
536 B 20ms
19ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0cce7a9d4d1a1ac6c23ba4f47d14915d63fca619b1ce77f4d2333feb390a9bd0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-7YpTkD6F03dDaw6E5EUX4A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-7YpTkD6F03dDaw6E5EUX4A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:49 GMT
expires: Wed, 31 May 2023 13:28:49 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js Show response
pagead2.googlesyndication.com/bg/ Frame 22E7 37 KB
14 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d53d7da4dd34d0c84942abb930cd555068569f5ad8fdc2ef1024b9a7d975e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:53:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 11:53:48 GMT

GET
H3 200 03032023-031222791-640_200_intro_animation_kompakt_einzelbilder-reduziert-234713879-1673-4e92-91cd-089543780eaa.gif
s0.2mdn.net/4528404/ Frame C8A6 13 KB
13 KB 13ms
13ms Image
image/gif 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031222791-640_200_intro_animation_kompakt_einzelbilder-reduziert-234713879-1673-4e92-91cd-089543780eaa.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

93935d73fa7a024694fc19c71b5a4f619f378da050a76b6ccf1f32c7ab5a3432

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 22:02:47 GMT
x-content-type-options: nosniff
age: 55562
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13261
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 31 May 2023 22:02:47 GMT

GET
H3 200 03032023-031224792-640_200_stoerer-gbplus2722f639-478f-4d75-bfc4-f30d15c3fc22.png
s0.2mdn.net/4528404/ Frame C8A6 29 KB
29 KB 14ms
14ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031224792-640_200_stoerer-gbplus2722f639-478f-4d75-bfc4-f30d15c3fc22.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17d77c7dd216bcb53dc6bf5bc41d7fec720dd74abb16207be161877316808f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 20:03:42 GMT
x-content-type-options: nosniff
age: 62707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29367
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 31 May 2023 20:03:42 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6636 0
0 42ms
40ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230525&jk=4406493206897173&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 703D 0
20 B 44ms
44ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B--NbkEt3ZP7hHOCPjuwP9OGLgAIAAAAAOAHgBAI&bg=!XF-lXwvNAAZu7ficTu07ADkAdvg8Wi6G5Gox8VJqM2olu5Xrqr0JmdKinzej8i6idDpsVvAowwoLuoVSSrs-tfxVkaajbi-nsm0CAAABslIAAAADaAEHCgCXoiiWaBjcEUkosJpkR2jhyoUiMiE_Pmsbt6ZK6ROaTqRr1Ev3vbEn4d1cuVSiSFUa72NLZINJ2t5mWHyQ15XB7h4ZWWxHsxjm9r_nKk-SW30lvk2Rn4vaiAZmEYADO4lecYp61YHLCmkYQNWGfg7c6gsYBJUAK4rfXZpxsgJIacthhPbrfJXSg4MgaigXE_7gAY0ZOf0l6JkC85zDmRTmj51ZeXCOX3diBSj-5y1sw9-Q2M2HDNGN-_MhaCUfvX-8oKb66dbz8f06rJpDLv_w8oWqGLP1IXDGXMXXcYT3YNcYaVhVnVvf4sg5eipSdSNMUaQiw3dArlgMx-oxKSlGZdi8OyjTnpEtML9VJv12OLaMBdSEMBXcJHkkMk6XGdRpz0BsoadMhn59BO-RfaHaHgnyDl0-FCOGX9IUJWZaAU5KC7iWQDO9AiZn7BzaKlEWfdQXSycvHxgackB3IhxYDcP6EFPwTC0tkf7HHizSZPeZMBjJj23Ly7idd1D02oltYRyBRgrH-3bTTyob0_8RP1X2Z0CBHJ19zxnkiMG6_Rar-G5tmA0a06Tozp_gguYGKOmnMiaxSmuJmkE0kDsH0WaLvN9qUljkOS9uSdyVJup0o1rm6SyYh7hgxEVM8-g9Eu7QmG6PyIg458vHmGTUG7-j41zVLrMQ9AAM-0o1OB0L3nV_s3LUmRNdXRGK6GrYcV6GoAgy7Xv05mNHM_M2M16fEvJkacDpZ1zpD4USkNA4ZGF4C5ugpzxXl4Y5pnuaqXDPf-pWIdrHLVobMlp7-gw2qVoAYp1tABlBzmlXvTowAr3UEKS-fr8nN6nIWJ5nAQR1w3Dj4IwGO7yPY7gj-lHru8cLjn4fAR4KgWf7DpGFLd9m91xKdcD07ZsKzHx3aRAftvS3C9-CoUw8p9k1Ig6Fm_Dp5YXVGPJ56McyUElh945JzuYn4S1NvUA7fhdjDS4wLkX_pZZzXRmMpYusChbNurhYDFUbppD_ZVfIXMn2JkkPS5bsywQzSJBM-CyfCmckj8J5o6lSj3c85bIWescVzX6kmjZqypsW7uoU1TJJIb1EPEKeBJjEdDaARgdIFoVKz735qThOqwC9v-_CVnsuVo7A7SL1uAn2JB-5KyPZxjCy6tQSQOMX_viZetB1wLuX9_i4sHteiAEPg1EMGqMv62FtODU7D2fH2vD3wlsoSAHoxEbOJ5inPOKn

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 03032023-031222791-640_200_intro_animation_kompakt_einzelbilder-reduziert-234713879-1673-4e92-91cd-089543780eaa.gif
s0.2mdn.net/4528404/ Frame C8A6 13 KB
13 KB 6ms
6ms Image
image/gif 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031222791-640_200_intro_animation_kompakt_einzelbilder-reduziert-234713879-1673-4e92-91cd-089543780eaa.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

93935d73fa7a024694fc19c71b5a4f619f378da050a76b6ccf1f32c7ab5a3432

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 22:02:47 GMT
x-content-type-options: nosniff
age: 55562
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13261
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 31 May 2023 22:02:47 GMT

GET
H3 200 1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js Show response
pagead2.googlesyndication.com/bg/ Frame 74D8 37 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/1T19pN000MhJQqu5MM1VUGhWn1rY_cLvECS5p9l14sM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d53d7da4dd34d0c84942abb930cd555068569f5ad8fdc2ef1024b9a7d975e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 11:53:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14705
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 11:53:48 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 74D8 0
11 B 6ms
6ms Image
text/plain 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?DctDzw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 index.html Show response
cdn.districtm.io/ids/ Frame F36E 116 B
434 B 33ms
7ms Document
text/html 13.32.121.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/index.html
Requested by: Host: static.visajourney.com
URL: https://static.visajourney.com/prebid/prebid3.26.0-20200716.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-15.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f752ad8cf812a358129aac3fd9784b0baf6f19899eb49116f08a1afab1fa133e

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 59152
content-length: 116
content-type: text/html
date: Tue, 30 May 2023 21:02:59 GMT
etag: "517f2062d883c0ee35479a2da0c50b8c"
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: AmazonS3
via: 1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront)
x-amz-cf-id: JavBtVez1KYPuWZWa3qwdz9RqXFPRGDdi5MqrjwY6YrVEoenzzmqKg==
x-amz-cf-pop: FRA60-P1
x-cache: Hit from cloudfront

GET check.html
biddr.brealtime.com/ Frame 4899 0
0

GET
H/1.1 200
OK beacon Show response
ap.lijit.com/ Frame 5626 4 KB
2 KB 14ms
14ms Document
text/html 216.52.2.91
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13395266
Requested by: Host: static.visajourney.com
URL: https://static.visajourney.com/prebid/prebid3.26.0-20200716.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.91 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: c21d4f6f46c00e674dd5b5d176f8ed33ba4ea42ae250ac5c473359c6e12d78e4

Request headers

Referer: https://www.visajourney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Encoding: gzip
Content-Length: 1007
Content-Type: text/html
Date: Wed, 31 May 2023 13:28:50 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
Vary: Accept-Encoding, User-Agent
X-Sovrn-Pod: ad_ap1ams1

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 5626 0
187 B 13ms
13ms Image
text/plain 98.98.134.242
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=23&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.242 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=sovrn&gdpr=0&gdpr_consent=
https://ad.turn.com/r/cs?pid=45&rndcb=5523026177
https://sync.1rx.io/usersync/turn/2654024907664701332?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-16a0e8a5-3e38-4aff-b81d-5277e8972e9f-003?redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D97%263pid%3DRX-16a0e8a5-3e38-4aff-b81d-5277e8972e9f-003
https://ce.lijit.com/merge?pid=97&3pid=RX-16a0e8a5-3e38-4aff-b81d-5277e8972e9f-003

43 B
2 KB

33ms
23ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=97&3pid=RX-16a0e8a5-3e38-4aff-b81d-5277e8972e9f-003
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=97&3pid=RX-16a0e8a5-3e38-4aff-b81d-5277e8972e9f-003
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX16a0e8a53e384affb81d5277e8972e9f003
content-type: text/html

GET
H/1.1 204
No Content sync.php
pixel-us-east.rubiconproject.com/exchange/ Frame 5626 0
239 B 384ms
95ms Image
image/gif 69.173.151.100
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=sovrn&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.151.100 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 0190a17a18f2299b1b85aeb1793e601c
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558511&ev=1&rurl=https%3A%2F%2Fce.lijit.com/merge?pid=49&3pid=%%VGUID%%&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=49&3pid=FRyAPVKc064G&ev=1&pid=558511&gdpr_consent=&gdpr=0

43 B
2 KB

18ms
17ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=49&3pid=FRyAPVKc064G&ev=1&pid=558511&gdpr_consent=&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: de-DE
location: https://ce.lijit.com/merge?pid=49&3pid=FRyAPVKc064G&ev=1&pid=558511&gdpr_consent=&gdpr=0
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-6d945594b4-bcrlm
expires: -1

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://x.bidswitch.net/sync?ssp=fmx&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=fmx&bsw_custom_parameter=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=0&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=fmx&bsw_custom_parameter=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=0&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=d62df993-59f1-4dff-aed1-38535d4e2331&ssp=fmx&expires=30&user_group=5&bsw_param=b915fb27-e3e3-4a9d-87be-41d099952512
https://ce.lijit.com/merge?pid=26&3pid=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=&gdpr_consent=

43 B
2 KB

20ms
16ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=26&3pid=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: //ce.lijit.com/merge?pid=26&3pid=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=&gdpr_consent=
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D92%263pid%3D%24UID&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=92&3pid=8547382904122687855&gdpr=0&gdpr_consent=

43 B
926 B

44ms
14ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=92&3pid=8547382904122687855&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Date: Wed, 31 May 2023 13:28:50 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.68; 217.64.151.68; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 13d9cf7a-ec42-4584-bf6b-4ebd852ebd0d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://ce.lijit.com/merge?pid=92&3pid=8547382904122687855&gdpr=0&gdpr_consent=
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://cms.quantserve.com/pixel/p-CXt61zNBpKUt1.gif?idmatch=0&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=43&gdpr=&gdpr_consent=&us_privacy=&3pid=GL1jrxrrbagDvjGrTbt5-hm5Y60DuGGvGL4tQk4c

43 B
947 B

46ms
16ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=43&gdpr=&gdpr_consent=&us_privacy=&3pid=GL1jrxrrbagDvjGrTbt5-hm5Y60DuGGvGL4tQk4c
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://ce.lijit.com/merge?pid=43&gdpr=&gdpr_consent=&us_privacy=&3pid=GL1jrxrrbagDvjGrTbt5-hm5Y60DuGGvGL4tQk4c
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=185&cm=GvNopBZHYNIQZEYqS7COidd-&redir=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D84%263pid%3D%7Bvisitor_id%7D&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=84&3pid=c:0f4cbfbcbf8809c26af75b7b861bbe58

43 B
3 KB

16ms
15ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=84&3pid=c:0f4cbfbcbf8809c26af75b7b861bbe58
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:50 GMT
server: Aorta/20230525.b9caa956e
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: text/plain
location: https://ce.lijit.com/merge?pid=84&3pid=c:0f4cbfbcbf8809c26af75b7b861bbe58
access-control-allow-origin: *
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: 1ea4aa63f56f
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H2 200 generic
data.adsrvr.org/track/cmf/ Frame 5626 70 B
264 B 36ms
32ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.adsrvr.org/track/cmf/generic?ttd_pid=federatedmedia&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/svr?gdpr=0&gdpr_consent=&_bee_ppp=1
https://ce.lijit.com/merge?pid=85&3pid=AAD72U7I7pcAACCYeocYrg&gdpr=0

43 B
3 KB

26ms
24ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=85&3pid=AAD72U7I7pcAACCYeocYrg&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=85&3pid=AAD72U7I7pcAACCYeocYrg&gdpr=0
Date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 5626 0
239 B 45ms
8ms Image
image/gif 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=sovrn-onscroll&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://um.simpli.fi/lj_match?r=1685539730134&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=2&3pid=E20BAD250DCE40CF8769793E048E56EF

43 B
938 B

42ms
15ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=2&3pid=E20BAD250DCE40CF8769793E048E56EF
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://ce.lijit.com/merge?pid=2&3pid=E20BAD250DCE40CF8769793E048E56EF
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 30 May 2023 13:28:50 GMT

GET
H/1.1

200
OK

merge
ap.lijit.com/ Frame 5626
Redirect Chain

https://tr.blismedia.com/v1/api/sync/sovrn?gdpr=0&gdpr_consent=
https://ap.lijit.com/merge?pid=94&3pid=64774B919C8EE0F407B0994CBLIS&gdpr=0&gdpr_consent=

43 B
935 B

25ms
15ms

Image
image/gif

216.52.2.91
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/merge?pid=94&3pid=64774B919C8EE0F407B0994CBLIS&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.91 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap1ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ap.lijit.com/merge?pid=94&3pid=64774B919C8EE0F407B0994CBLIS&gdpr=0&gdpr_consent=
date: Wed, 31 May 2023 13:28:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=
https://creativecdn.com/cm-notify?pi=sovrn&gdpr=0&gdpr_consent=&tc=1
https://ce.lijit.com/merge?pid=86&3pid=jIWxgQR1IyMpxPzQ0AdQ&pi=sovrn&gdpr=0&gdpr_consent=&tc=1

43 B
2 KB

16ms
16ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=86&3pid=jIWxgQR1IyMpxPzQ0AdQ&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

location: https://ce.lijit.com/merge?pid=86&3pid=jIWxgQR1IyMpxPzQ0AdQ&pi=sovrn&gdpr=0&gdpr_consent=&tc=1
pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT, Wed, 31 May 2023 13:28:50 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

403

pixel
cm.g.doubleclick.net/ Frame 5626
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/beacon?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3ZOb3BCWkhZTklRWkVZcVM3Q09pZGQt&gdpr=0

0
0

17ms
17ms

Image
text/html

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3ZOb3BCWkhZTklRWkVZcVM3Q09pZGQt&gdpr=0
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: H3
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Redirect headers

Date: Wed, 31 May 2023 13:28:50 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_hm=R3ZOb3BCWkhZTklRWkVZcVM3Q09pZGQt&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5626
Redirect Chain

https://ap.lijit.com/dsp/google/cookiematch/dv?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3ZOb3BCWkhZTklRWkVZcVM3Q09pZGQt&gdpr=0

170 B
188 B

18ms
18ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3ZOb3BCWkhZTklRWkVZcVM3Q09pZGQt&gdpr=0

Requested by

Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 31 May 2023 13:28:50 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=lijit_dbm&google_hm=R3ZOb3BCWkhZTklRWkVZcVM3Q09pZGQt&gdpr=0
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame 5626
Redirect Chain

https://rtb.mfadsrvr.com/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://rtb.mfadsrvr.com/ul_cb/sync?ssp=sovrn&gdpr=0&gdpr_consent=
https://ce.lijit.com/merge?pid=87&3pid=b0377cca-ebcd-41ae-859b-277ecff7555b

43 B
2 KB

16ms
16ms

Image
image/gif

216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=87&3pid=b0377cca-ebcd-41ae-859b-277ecff7555b
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Location: //ce.lijit.com/merge?pid=87&3pid=b0377cca-ebcd-41ae-859b-277ecff7555b
Date: Wed, 31 May 2023 13:28:50 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

iu3
aax-eu.amazon-adsystem.com/s/ Frame 5626
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/x/ae12848777b41970a5f2?gdpr=0&gdpr_consent=
https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t

0
0

199ms
198ms

Image
text/html

52.95.122.74
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: HTTP/1.1
Server: 52.95.122.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ap.lijit.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 4ENWG3KJDHE1XWM3AZCV
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://aax-eu.amazon-adsystem.com/s/iu3?cm3ppd=1&d=dtb-pub&dl=sovrn&gdpr=0&gdpr_consent=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 8717 16 KB
6 KB 33ms
7ms Document
text/html 23.32.184.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=137711&s=137812&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D58%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.32.184.192 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-184-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=98462
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Wed, 31 May 2023 13:28:50 GMT
expires: Thu, 01 Jun 2023 16:49:52 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame E423 16 KB
6 KB 31ms
7ms Document
text/html 23.32.184.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.32.184.192 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-184-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=98462
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Wed, 31 May 2023 13:28:50 GMT
expires: Thu, 01 Jun 2023 16:49:52 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H2

200

cm Show response
us-u.openx.net/w/1.0/ Frame 48F4
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_c...
https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&g...

753 B
798 B

28ms
26ms

Document
text/html

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Requested by: Host: ap.lijit.com
URL: https://ap.lijit.com/beacon?informer=13395266
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: d152b8a7f0dfefcea323c2a26c0764073591669b15e2a536f063e5ba74152d47

Request headers

Referer: https://ap.lijit.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 463
content-type: text/html
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Wed, 31 May 2023 13:28:50 GMT
location: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
p3p: CP="CUR ADM OUR NOR STA NID"
server: OXGW/0.0.0
via: 1.1 google

GET
H2 200 idsync.d5cb6b96.js Show response
cdn.districtm.io/ids/ Frame F36E 3 KB
4 KB 7ms
6ms Script
application/javascript 13.32.121.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.districtm.io/ids/idsync.d5cb6b96.js
Requested by: Host: cdn.districtm.io
URL: https://cdn.districtm.io/ids/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-15.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 196b425485c119046eada45bc1a473e6c35f7f8c5a94824873535de823af517f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.districtm.io/ids/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 02:06:34 GMT
via: 1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront)
last-modified: Thu, 20 May 2021 02:18:27 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1
age: 40936
etag: "74ede07ef946dc2316f86b2661cf2dd3"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3302
x-amz-cf-id: lCyKxIYcrwYVdcGU35WJHhWeBm6UpSxFQ7JAsLh3G6uB-DrEcdkNnQ==

GET buyers
dmx.districtm.io/s/v1/ Frame F36E 0
0

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame E423 5 KB
6 KB 73ms
21ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=20241050&p=156212&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 5407e226e200120f3b1f8d49fe0865b9f3fb9e867db6e18540736fabcc487e4c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Wed, 31 May 2023 13:28:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK merge
ce.lijit.com/ Frame 48F4 43 B
2 KB 25ms
16ms Image
image/gif 216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=76&3pid=1fe67c27-d621-063f-17f2-d1097f6615ff
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 May 2023 13:28:50 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ams1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 48F4
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=41e36477-4b91-4100-b1f9-0139251a3334

43 B
180 B

46ms
24ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=41e36477-4b91-4100-b1f9-0139251a3334
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Wed, 31 May 2023 13:28:50 GMT
Server: MT3 851 9bd98ae master zrh-pixel-x12 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=41e36477-4b91-4100-b1f9-0139251a3334
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 31 May 2023 13:28:49 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 48F4
Redirect Chain

https://cms.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=0
https://us-u.openx.net/w/1.0/sd?id=537072956&&val=dg-87HRZsuttDO7oIwmmuXcLvO5tCr7sdgw82kjj

43 B
61 B

27ms
27ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&&val=dg-87HRZsuttDO7oIwmmuXcLvO5tCr7sdgw82kjj
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&&val=dg-87HRZsuttDO7oIwmmuXcLvO5tCr7sdgw82kjj
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 48F4
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1574298524842642957

43 B
106 B

48ms
26ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1574298524842642957
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1574298524842642957
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 48F4 70 B
264 B 35ms
34ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=7308a2e7-3c95-3c32-504e-67af07d72aad&gdpr=0
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame 48F4 170 B
188 B 19ms
18ms Image
image/png 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=NWY2NzcxMmQtZjVlMi02Mjk2LTQ1YWUtM2QxNmNkMzVlNGNk

Requested by

Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

186.62.91.34.bc.googleusercontent.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 48F4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEF9wpjpCb458GojHCnBeu58&google_cver=1

43 B
61 B

25ms
24ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEF9wpjpCb458GojHCnBeu58&google_cver=1
Requested by: Host: us-u.openx.net
URL: https://us-u.openx.net/w/1.0/cm?cc=1&id=dc2068a3-fa3d-4b5f-8a61-3d5a1a58fc05&ph=21f03281-5b83-4670-a0e0-dc15f7542014&r=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D76%263pid%3D%7BOPENX_ID%7D&gdpr=0&gdpr_consent=
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://us-u.openx.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEF9wpjpCb458GojHCnBeu58&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 7DCC
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:41e36477-4b91-4100-b1f9-0139251a3334&gdpr=0&gdpr_consent=

42 B
555 B

41ms
14ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:41e36477-4b91-4100-b1f9-0139251a3334&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Wed, 31 May 2023 13:28:50 GMT
Expires: Wed, 31 May 2023 13:28:49 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 851 9bd98ae master zrh-pixel-x14 config_version:"unknown"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:41e36477-4b91-4100-b1f9-0139251a3334&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 9EB2
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5142336723463062042

42 B
194 B

20ms
20ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5142336723463062042
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Wed, 31 May 2023 13:28:50 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5142336723463062042
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 usersync.aspx Show response
dis.criteo.com/dis/ Frame B9D4 43 B
362 B 14ms
14ms Document
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:@@CRITEO_USERID@@

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache
content-type: image/gif
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 13:28:49 GMT
expires: Wed, 31 May 2023 00:00:00 GMT
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 279793
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 35BC
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=9127448100213036220

42 B
424 B

65ms
19ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=9127448100213036220
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=9127448100213036220
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H/1.1

200
OK

dcm Show response
aax-eu.amazon-adsystem.com/s/ Frame 14AB
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B&redir=true&gdpr=0&gdpr_consent=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B&redir=true&gdpr=0&gdpr_consent=&dcc=t

43 B
855 B

204ms
192ms

Document
image/gif

52.95.122.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B&redir=true&gdpr=0&gdpr_consent=&dcc=t

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.95.122.74 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Wed, 31 May 2023 13:28:50 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: 319GKAVSGAHDGBG4KG9C

Redirect headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Date: Wed, 31 May 2023 13:28:50 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://aax-eu.amazon-adsystem.com/s/dcm?pid=4bd6ceca-c698-4782-a536-f380f757484c&id=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B&redir=true&gdpr=0&gdpr_consent=&dcc=t
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: E9P7F5GY0MY7279TJZ8B

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame D17A
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ABQyJAJCPCMbF2AgVRIocQEQMiYbETAkABe1m8ya

42 B
339 B

77ms
20ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ABQyJAJCPCMbF2AgVRIocQEQMiYbETAkABe1m8ya
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Wed, 31 May 2023 13:28:50 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=ABQyJAJCPCMbF2AgVRIocQEQMiYbETAkABe1m8ya
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 4830
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8547382904122687855&gdpr=0&gdpr_consent=

42 B
218 B

47ms
15ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8547382904122687855&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

AN-X-Request-Uuid: 01aae10b-865f-43e5-a7bd-8a4b992d2d34
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Wed, 31 May 2023 13:28:50 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=8547382904122687855&gdpr=0&gdpr_consent=
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
X-Proxy-Origin: 217.64.151.68; 217.64.151.68; 1006.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame F5C2
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=9&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7239338012175431823&gdpr=0&gdpr_consent=

42 B
219 B

43ms
14ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7239338012175431823&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Date: Wed, 31 May 2023 13:28:50 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzOTkmdGw9NDMyMDA%3D&piggybackCookie=7239338012175431823&gdpr=0&gdpr_consent=
Server: nginx
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 8773
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFGNVVrN0k3cGNBQUNOOVFyM3Fidw&gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_syn...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=sas%2Cpp%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://rtb-csync.smartadserver.com/redir?partnerid=127&partneruserid=AAF5Uk7I7pcAACN9Qr3qbw&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dpp%252Cpm%26bee...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=pp%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=2&userid=1465743163147937912&gdpr=0&gdpr_consent=
https://bh.contextweb.com/bh/rtset?do=add&pid=558502&ev=AAF5Uk7I7pcAACN9Qr3qbw&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26userid%3D1465743163147937912%26gdpr%3D0%26gdpr_consen...
https://match.prod.bidr.io/cookie-sync?gdpr=0&userid=1465743163147937912&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=3&ev=AAF5Uk7...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAF5Uk7I7pcAACN9Qr3qbw&gdpr=0&gdpr_consent=

42 B
199 B

21ms
21ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAF5Uk7I7pcAACN9Qr3qbw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Wed, 31 May 2023 13:28:50 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAF5Uk7I7pcAACN9Qr3qbw&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET b9pj45k4
sync-tm.everesttech.net/upi/pid/ Frame F0A1 0
0

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A669
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=EevQHwnsVlpmj8yZMStzWNlAl0Q&gdpr=0&gdpr_consent=

42 B
299 B

16ms
16ms

Document
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=EevQHwnsVlpmj8yZMStzWNlAl0Q&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 188
Content-Type: text/html; charset=utf-8
Date: Wed, 31 May 2023 13:28:50 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=EevQHwnsVlpmj8yZMStzWNlAl0Q&gdpr=0&gdpr_consent=

GET
H2 200 bridge Show response
cm.adgrx.com/ Frame F371 43 B
283 B 62ms
14ms Document
image/gif 72.251.241.204
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 72.251.241.204 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate
content-length: 43
content-type: image/gif
date: Wed, 31 May 2023 13:28:50 GMT
expires: Thu, 23 Sep 2004 17:42:04 GMT
p3p: CP="NOI OTC OTP OUR NOR"
pragma: no-cache
server: Cowboy
x-realserver-nx: ams-delivery-6

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame E531
Redirect Chain

https://csync.loopme.me/?pubid=11331&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzImdGw9MTI5NjAw&piggybackCookie={viewer_token}
https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}

0
74 B

15ms
13ms

Document
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 31 May 2023 13:28:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
date: Wed, 31 May 2023 13:28:50 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode&piggybackCookie={viewer_token}
server: _

GET
H2 200 cm Show response
ipac.ctnsnet.com/int/ Frame BCC7 43 B
369 B 46ms
16ms Document
image/gif 35.186.193.173
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ipac.ctnsnet.com/int/cm?exc=14&redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MTEmdGw9MjAxNjA=&piggybackCookie=[user_id]
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.193.173 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 173.193.186.35.bc.googleusercontent.com
Software: Apache-Coyote/1.1 /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 43
content-type: image/gif
date: Wed, 31 May 2023 13:28:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: CP="NOI DSP COR NID CUR OUR NOR"
pragma: no-cache
server: Apache-Coyote/1.1
via: 1.1 google

GET
H/1.1 200
OK cookiesync Show response
core.iprom.net/ Frame 4BC6 43 B
280 B 118ms
28ms Document
image/gif 195.5.165.20
IPROM-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://core.iprom.net/cookiesync?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 195.5.165.20 , Slovenia, ASN44968 (IPROM-AS, SI),
Reverse DNS
Software: /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: close
Content-Length: 43
Content-Type: image/gif
Date: Wed, 31 May 2023 13:28:50 GMT
Vary: Accept-Encoding
X-adserver-worker: leviathan-c5b358f8d136@version_1.552
X-core-time: 1ms
X-server-arch: v2

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame BEB4
Redirect Chain

https://cm-supply-web.gammaplatform.com/adx/usersyncsupply?pid=7&t=pixel
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTkmdGw9NDMyMDA=&piggybackCookie=g7nj8uywtln3

42 B
231 B

20ms
20ms

Document
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTkmdGw9NDMyMDA=&piggybackCookie=g7nj8uywtln3
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

accept-encoding: utf-8
cache-control: no-cache, no-store
content-length: 0
date: Wed, 31 May 2023 13:28:50 GMT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0NTkmdGw9NDMyMDA=&piggybackCookie=g7nj8uywtln3
lws: 90
strict-transport-security: max-age=31536000; includeSubDomains
time-ms: 1

GET
H2

200

i.match Show response
s.tribalfusion.com/z/ Frame F1CA
Redirect Chain

https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATI...
https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMA...

43 B
418 B

187ms
186ms

Document
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7cff8ff3ad4a2bf7-FRA
content-length: 43
content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 7cff8ff29ba62bf7-FRA
content-type: text/html
date: Wed, 31 May 2023 13:28:50 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://s.tribalfusion.com/z/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 206
x-reuse-index: 400

GET
H/1.1 200
OK merge Show response
ce.lijit.com/ Frame 456D 43 B
3 KB 24ms
19ms Document
image/gif 216.52.2.6
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ce.lijit.com/merge?pid=71&3pid=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.6 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Content-Length: 43
Content-Type: image/gif
Date: Wed, 31 May 2023 13:28:50 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap2ams1

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame E423
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=56KsvdoDTnee1MarFLfyWw%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

8ms
8ms

Image
text/html

23.32.184.192
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 23.32.184.192 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-184-192.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:50 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=98462
accept-ranges: bytes
content-length: 5554
expires: Thu, 01 Jun 2023 16:49:52 GMT

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 qmap
sync.crwdcntrl.net/ Frame E423 49 B
266 B 122ms
32ms Image
image/gif 54.194.218.69
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.218.69 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-218-69.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.26.185
content-length: 49
expires: 0

GET
H2

204

ids
idsync.frontend.weborama.fr/ Frame E423
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=1592066296
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B

0
284 B

41ms
15ms

Image
text/plain

34.111.131.239
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 34.111.131.239 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 239.131.111.34.bc.googleusercontent.com
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
via: 1.1 google
last-modified: Wed, 31 May 2023 13:28:50 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

location: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B
date: Wed, 31 May 2023 13:28:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1

200

p
a.audrte.com/ Frame E423
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=YjAyOUZlaEd2eHpUck9NQkJWU3E3Ums3QQ==&google_redir=https%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbeyJuYW1lIjoiYWRmb3JtIn1dfQ%3D%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=1574298524842642957&r=eyJ1IjoiaHR0cHM6Ly9hLmF1ZHJ0ZS5jb206NDQzL3AiLCJkIjpbXX0%3D
https://a.audrte.com/p

68 B
424 B

104ms
104ms

Image
image/png

52.44.244.58
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: HTTP/1.1
Server: 52.44.244.58 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-44-244-58.compute-1.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Wed, 31 May 2023 13:28:51 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/png
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 68

Redirect headers

Date: Wed, 31 May 2023 13:28:50 GMT
Server: nginx/1.18.0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST, GET, OPTIONS
Access-Control-Allow-Origin: *
Location: https://a.audrte.com:443/p
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=RTdBMkFDQkQtREEwMy00RTc3LTlFRDQtQzZBQjE0QjdGMjVC&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

58ms
21ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDvHPZO_2cHly2VqQdz0yzA&google_cver=1

42 B
300 B

59ms
20ms

Image
image/gif

185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDvHPZO_2cHly2VqQdz0yzA&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEDvHPZO_2cHly2VqQdz0yzA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame E423 43 B
409 B 21ms
14ms Image
image/gif 34.91.62.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.91.62.186 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Tue, 30 May 2023 13:28:50 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1574298524842642957

42 B
243 B

19ms
17ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1574298524842642957
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=1574298524842642957
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame E423 70 B
264 B 38ms
31ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-SrrtsLhE2uVtbmc0v9_hKW7SyEKs268-~A&gdpr=0

0
261 B

52ms
17ms

Image
text/plain

198.47.127.20
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-SrrtsLhE2uVtbmc0v9_hKW7SyEKs268-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 198.47.127.20 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:49 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-SrrtsLhE2uVtbmc0v9_hKW7SyEKs268-~A&gdpr=0
date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame E423 43 B
601 B 40ms
34ms Image
image/gif 2a05:d018:d29:3602:d19f:1de7:e73f:73f7
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B?gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3602:d19f:1de7:e73f:73f7 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:50 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=b915fb27-e3e3-4a9d-87be-41d099952512
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=pubmatic&bsw_custom_parameter=b915fb27-e3e3-4a9d-87be-41d099952512
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=dd7e78ac-1228-43c0-abf1-ac0c7afd100d&user_group=1&ssp=pubmatic&bsw_param=b915fb27-e3e3-4a9d-87be-41d099952512
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=&gdpr_consent=&gdpr_pd=

1 B
166 B

13ms
13ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=b915fb27-e3e3-4a9d-87be-41d099952512&gdpr=&gdpr_consent=&gdpr_pd=
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H2 204 current
pubmatic-match.dotomi.com/match/bounce/ Frame E423 0
103 B 19ms
13ms Image
text/plain 89.207.16.140
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=E7A2ACBD-DA03-4E77-9ED4-C6AB14B7F25B&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 89.207.16.140 Amsterdam, Netherlands, ASN41041 (VCLK-EU-SE, US),
Reverse DNS: ams03-nessy-float2.dotomi.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame E423 0
187 B 18ms
12ms Image
text/plain 98.98.134.242
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=3&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.242 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2654024907664701332&gdpr=0&gdpr_consent=&us_privacy=

1 B
274 B

15ms
15ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2654024907664701332&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Wed, 31 May 2023 13:28:50 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=2654024907664701332&gdpr=0&gdpr_consent=&us_privacy=
pragma: no-cache
date: Wed, 31 May 2023 13:28:49 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://match.adsby.bidtheatre.com/pubmaticmatch?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:7b607df5-814e-4533-91bf-773c272ab017&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw

42 B
95 B

14ms
13ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:7b607df5-814e-4533-91bf-773c272ab017&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:52 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Location: https://simage2.pubmatic.com/AdServer/Pug?gdpr_consent=&gdpr=0&piggybackCookie=uid:7b607df5-814e-4533-91bf-773c272ab017&vcode=bz0yJnR5cGU9MSZjb2RlPTMwNjImdGw9MTI5NjAw
Date: Wed, 31 May 2023 13:28:53 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame E423
Redirect Chain

https://ads.playground.xyz/usersync/apn?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://secure.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=$UID
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8547382904122687855

42 B
95 B

16ms
15ms

Image
image/gif

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8547382904122687855
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Wed, 31 May 2023 13:28:48 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

Date: Wed, 31 May 2023 13:28:50 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.64.151.68; 217.64.151.68; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: eae91f51-a7ca-4503-931b-755db1ebfd30
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MDEmdGw9NDMyMDA=&piggybackCookie=8547382904122687855
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4972 42 B
64 B 49ms
49ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuB7aueAEuvbmYfINuy051Z4aQ6e8vNlTQNkEqEV7DivRe_JulFY_UiFjIVw8gBMT-kRauSSDoKuFOEFx1vIpK2dXIKO5wwFW2Pf8ft-jr2ahWEdUbuGvfXJ2u72hMLSgYPhZIBwhTYLdIVxQfBhglVN9F2YpCiNC0f&sai=AMfl-YSxwOj13EIsjQlrvaidbZF8OVenB4PuVMgSBqpT_IERYv-ZeMaQegO4zpy_SH16ZbAk4yhmFAhL7HH3gqzko4aDG9bZxvvMyt8&sig=Cg0ArKJSzA8ua0Cu7r2uEAE&cid=CAQSKQBygQiDBm3hu98yhAi9fxFphje_qe6c-Czfau8moEfvQjitPlmyuKK2GAE&id=lidar2&mcvt=1000&p=0,0,280,1198&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230524&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2600020922&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685539727376&rpt=2122&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 15E3 0
20 B 40ms
40ms Ping
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7358323133021&version=m202301230201&ct=76&x=1&cor=3281435173975183400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://0e6fbf7c03a908ef9e8a41e0a8a844ec.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 May 2023 13:28:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230525&jk=4406493206897173&bg=!AwClAFTNAAZu7ficTu07ADkAdvg8Wrv36c0bfb3I38RJCZ0Zh0TShaN0xjxHavnR7Oga2rVKat6ol6k_mBD7S6gpujNMz6OGECUCAAAAglIAAAADaAEHCgDWf3vV9zrE3Ozq0Skzk0zEZmG1h8QehMVk8u7mp42ISNCLp5PWemnfA5ZAthObXga_Yqc_o4FMKkTbzh_XTSdgzUMbeb5t_FRZlCBnpGdSeWasgIevAHtLL-J4JGHGCyxUZBxK3HDSKzs9Uda7K_PJmUdVegthcCaUvQuh2ytGCUm1scHbWGatOhjWtBmSfTLzg4MtkIbJDLYpQodtQT-OotOf5HKaHR-7FtdikDqjYsNhpMBf876WKawjP9muknsSF6D67XDi-JiUzRj-ck8wc2FvmBJvipkCqKd-U8MzITuTCryNY9wogKJTd3F25oZzD_SsBqJWYjFW19jkONF3V1xIwLCkDQd0DjvScMy5SeOiMTeQz32CG6rQpM5Ujkig52ycHIkMg9LLws8BeBKc-EWn9zl9qpl9Vbot73iKzgLTL1J_R-rOLHG5Gnbz81lUyAV8rnhzGQiuMNcCT7uMr75IbpIg2sm4EUhHJ5GSKZEcR5SpWySDYDYcmsejsCssmDf7SLVndcrU-Zi_QFS9xbjqZgDcjDAw3Ot-xeEGtdAhUwP_PmCKL_a5YL0upuaH-c73H5FtOL9Rm_hY-YDbq1KHW9KhCPTMtWabiY9-lX9PjiCC4jXaCMrIMjO4mikKvpy9zLfgBJYi-_KYivwfv1efP9Eaikp0QwF0PUFrxY4hLrOZuwHLyu7CpoGoJe56UlenJPhR91YC5zb05yNe6oggvO5PO3IRaT9pkr0r0K2Pg5CRiA8o9oKG3ZHty49rmaTa7XRx4JGkKWcWM8fC8WvUQr_4k_0Vv-z0qYbYyE3fGuMQOxiNNrEPnah1YKHS03aBAKJHQuxV8TyBzPUmpvbCJnTb-1wEZq5K9yFFdxHKSHGYeCIEyXq-YVMgoudvYIoJ_JPekSOM0yIWIgfJfd5FXD5T5BbgwwKFQci5BjA7EfCNvlhFhwBOhDcjZBYtBN0BQeZhRevfAkhm0jhMPmMZK1c26cPxC-1SkPWMFT7SpkzEQmlRd1ohRl7LqxTJYrKz_9FF0oh6foD6FVvCpt2Hszf4ChyvSdHdAUrhY5Fwd34Gj6kp-o5qpHMy2AI3uVr5PtfwmUmT4ngDs4pM_pBs3bMTYA8EYBRWR2fP08TOd9_kyJrgYs52KvIg2uDhvAPvNfFv3FVl15mt8U41yXKtiy-eoaXjiY4KfETJkTf7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.visajourney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

GET
H2 200 SPug Show response
simage4.pubmatic.com/AdServer/ Frame E423 0
128 B 16ms
14ms Script
text/plain 198.47.127.20
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://simage4.pubmatic.com/AdServer/SPug?partnerID=156212&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156212&predirect=https%3A%2F%2Fce.lijit.com%2Fmerge%3Fpid%3D71%263pid%3D&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.20 , United States, ASN3257 (GTT-BACKBONE GTT, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Wed, 31 May 2023 13:28:50 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H3 200 03032023-031224792-640_200_stoerer-gbplus2722f639-478f-4d75-bfc4-f30d15c3fc22.png
s0.2mdn.net/4528404/ Frame C8A6 29 KB
29 KB 7ms
6ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/03032023-031224792-640_200_stoerer-gbplus2722f639-478f-4d75-bfc4-f30d15c3fc22.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

17d77c7dd216bcb53dc6bf5bc41d7fec720dd74abb16207be161877316808f9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12808310967564234678/index.html?e=69&leftOffset=0&topOffset=0&c=n30kA6uA31&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 20:03:42 GMT
x-content-type-options: nosniff
age: 62710
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29367
x-xss-protection: 0
last-modified: Fri, 03 Mar 2023 11:12:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 31 May 2023 20:03:42 GMT

GET
H2 200 dc_oe=ChMI_umU5tSf_wIV4IeDBx308AIgEAAYACC33uxKQhMI7sri5dSf_wIVUVqkBB2EnglM;stragg=1;&timestamp=1685539732957;str=Show%20Slide%200;strtype=1
ade.googlesyndication.com/ddm/activity/ Frame 15E3 42 B
401 B 78ms
44ms Image
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI_umU5tSf_wIV4IeDBx308AIgEAAYACC33uxKQhMI7sri5dSf_wIVUVqkBB2EnglM;stragg=1;&timestamp=1685539732957;str=Show%20Slide%200;strtype=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS