yifysub.net Open in urlscan Pro
2a06:98c1:3121::7 Public Scan

Software

sffe /

Resource Hash

dd1ea0b6d75f18fcf79608f210615b84a991df4c429df06ec4d6e59c60d78e62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27141
x-xss-protection: 0
server: sffe
etag: "1130 / 798 of 1000 / last-modified: 1644620926"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H2 200 site.js Show response
protagcdn.com/s/yifysub.net/ 326 KB
97 KB 141ms
57ms Script
application/javascript 2606:4700:20::681a:78e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://protagcdn.com/s/yifysub.net/site.js
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:78e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 519942f3647a7fe0ffeb0283e9e46097fef7b8442f9f05d4cd104758767a36ad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2268
cf-polished: origSize=334246
cf-bgj: minify
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
pragma: no-cache
last-modified: Fri, 28 Jan 2022 18:12:29 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nv1s5VRK8hVlC0pGI708yKuU32SuBjzPL053uGyHQ3Sm8D9sLm06vflKCs8cBRooXpMVYtpk10u4%2B3AJ71yVrwAkXw5x2qFJiuMamcR6mbDfA8uiLbDfYg864iRS5xkMitblG3UxvBJVinU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
cf-ray: 6dcee186687e5a19-MXP
expires: Sun, 13 Feb 2022 15:22:31 GMT

GET
H3 200 logo.png
yifysub.net/images/ 19 KB
19 KB 84ms
82ms Image
image/png 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://yifysub.net/images/logo.png
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8dd4860bacdb6e7e9287b0c92ecf6cb08c6b5c20fdede947011367de2d86b91

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14485549
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19072
last-modified: Sun, 09 Feb 2020 09:08:30 GMT
server: cloudflare
etag: "5e3fcc0e-4a80"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BXe5TDuAaZxyvjItUCBUxznfkp9vRhfL7dmaU7doHVPBj1aoOReA5lFt3rhoupTMjDFHB9ZeGOe0wlqu1bV6FdDbb2ZfyXRgUWlAYJKww5ZUouMdGHpT0LfPSgJ9mo1gJctcJKKGbU2NYg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 6dcee185fd2d83a6-MXP
expires: Mon, 29 Aug 2022 23:06:42 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 151 KB
53 KB 67ms
44ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39155d0c0c823faaa142a0116e57ff4a6680b447e703140c2bb061da9cb77789

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53232
x-xss-protection: 0
server: cafe
etag: 15441807256063247056
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H2 200 faust-1910.jpg
eztvtorrentz.com/images/cover/ 9 KB
9 KB 139ms
52ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/faust-1910.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25dfc4415bed3c77f72876231720d6eb7f47fb775c25951f8ab4b8f662bb3520

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9362
last-modified: Sun, 15 Aug 2021 16:08:52 GMT
server: cloudflare
etag: "2492-5c99b4cffe1c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dtr%2Bap5HTeaay7POjXspBzH7MaT1MfSTXSogYYvCWCbdhukacocT1gTcbUVJ4sZz87DhFXypFrQbYaldDbZp5JITicDBn98m2sQPj7t1TH4M9jJuvqHEtgsn8Xd91eFVZMJWFOA0MeKJ0yfGy8yy"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1867f640e0e-MXP

GET
H2 200 the-birth-of-a-nation-1915.jpg
eztvtorrentz.com/images/cover/ 37 KB
37 KB 130ms
85ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/the-birth-of-a-nation-1915.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6099d8b4d2a7df85b40fc7581475dde9e39c3d84ac5133ec1a2915de9934839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37695
last-modified: Sun, 12 Sep 2021 11:02:05 GMT
server: cloudflare
etag: "933f-5cbca4769450c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S4QOeqTzP4iHp%2FmlNrDNZreXqsPBPaD1rtv4jN08%2F0JD1Su9czCAapj%2FGYwlfnjka%2Fawz%2FtYK6KCfEDqaQTFJarn22fUsRWcePz6PmlMntWBdvNLTmFzd9OCIe6rVmbJkey%2BDJaL5%2FZN2tdIKeUZ"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1867f680e0e-MXP

GET
H2 200 a-burlesque-on-carmen-1915.jpg
eztvtorrentz.com/images/cover/ 43 KB
44 KB 94ms
49ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/a-burlesque-on-carmen-1915.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14e4b85ea58b39b26fb8aa111b9000f85213ae73d4cac014daa26ea9cc0c7f9b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44314
last-modified: Tue, 12 Nov 2019 07:35:53 GMT
server: cloudflare
etag: "ad1a-597214c4815ee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Vcv6ToiLhMLEOgOPyQL8MrgscUtqM4ZCz9abNSmbuWyptk6eKbqJI84iyaBbYYm9Jt%2FAZotLJAbeSGqETwpYf1Zy46vvzcFTOQuqUIBC5a2UUazqas9MTOCjd3DQ2CPwNjBrMTjLksPrVz3kWcb"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1867f750e0e-MXP

GET
H2 200 the-tunnel-1915.jpg
eztvtorrentz.com/images/cover/ 17 KB
17 KB 130ms
85ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/the-tunnel-1915.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1565391c55a6d799bb5f9c479342ae7a22c497d23e6887f90f1e9f63d8ceb82

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 16983
last-modified: Fri, 29 May 2020 15:18:45 GMT
server: cloudflare
etag: "4257-5a6caf60eef91"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w90vWZxhWCNDXQ9KL5GimLOF71NkU5tdjQaG9DWDDpgKuRHJjYUj%2BGTNyAtfriaqG0H1p1iZ4U%2BcH91%2Bh0rI9m790KQp2Yf1uKtk%2FMQp2Kba1eNWDnf7jBbulE%2FzsKq7zN8cjmMSDZvF8G9mIqQq"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1867f610e0e-MXP

GET
H2 200 the-champion-1915.jpg
eztvtorrentz.com/images/cover/ 29 KB
30 KB 129ms
86ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/the-champion-1915.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f7f2c60bc1024bc0d6c4360e7c02a025ccab36c731edbce2d49723d4b0227a11

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 30107
last-modified: Fri, 17 Dec 2021 04:07:37 GMT
server: cloudflare
etag: "759b-5d34fadea9a2a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cFZ6oI2IeMkrb8tr5S%2FUXd4izG1rQIJaBdzGhth%2FxnV%2B9Ep%2BYCPkdHyZz1zTLJKOzXRhxLOtMy4ZZ2DI7jlNVRAL5Uq8jMEfHaQZgjep%2Bsv3QnPg1T%2FJCYQZM5012dkHGUw1vNPkjS0lKyCbcyYi"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1867f760e0e-MXP

GET
H2 200 the-cheat-1915.jpg
eztvtorrentz.com/images/cover/ 31 KB
31 KB 97ms
53ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/the-cheat-1915.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ede09801f1df7b4194cac003de5263aeadbabf7663609c9b3d0bee3111870724

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 31769
last-modified: Sat, 18 Dec 2021 10:02:20 GMT
server: cloudflare
etag: "7c19-5d368c0538265"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JcoVNuvFHc1VEgIxnJ5k7hsqypDakJgQk1OiUGiL7poip659js3nLCRFdmniyEn2wVGnCB%2BsIx2xP%2BPGXETZEOrsnrtpFEQ0DKMvxEgDlQqG5xco4BdO6Bvjv7HUnI3qN1AklPeVk3jpXhvyHzRB"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1867f6e0e0e-MXP

GET
H2 200 filibus-1915.jpg
eztvtorrentz.com/images/cover/ 29 KB
29 KB 127ms
83ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/filibus-1915.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ca595729a6d388b487bd2f61aa87517e9bd0dd7dc60aa4cd3b21ebaadb1c64de

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 29370
last-modified: Tue, 11 Jan 2022 03:58:36 GMT
server: cloudflare
etag: "72ba-5d54677b2fb32"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FBLAJB2HEmHMWD20fjDitwzSUZG1lkXtBysRMMVIG6QwEhugc7ybk10Q0ZNtLGLu8eZnfkI51e6Vz%2FYqEflVu%2FyFsH1JbZwbYD7DniYkYjY106oW1tHq7MAGG6%2FQsKUuGKlGRKucCYtzuLK1JcmE"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1867f660e0e-MXP

GET
H2 200 behind-the-screen-1916.jpg
eztvtorrentz.com/images/cover/ 28 KB
28 KB 78ms
73ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/behind-the-screen-1916.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fcf3268f6a03d765176df7c977580b2f3800f1e57fae31cf8887a5de54a90966

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 28535
last-modified: Tue, 12 Nov 2019 07:35:30 GMT
server: cloudflare
etag: "6f77-597214af6ddfc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cPvXHhyRV2jYd6xZ7cvSwke082aCSiLrxBIfL12rp8sA8z6YYi9u%2Bcn1sPAAo6j9TX0oa0rGJZBBQ056HEwu3tmauXboOXG4p5SmOD%2Fig3jX2tMyXtRseNMGH6V86WrNAOEYyZGO2S1NN5AAQ3B7"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee1868f8a0e0e-MXP

GET
H2 200 the-count-1916.jpg
eztvtorrentz.com/images/cover/ 36 KB
37 KB 79ms
74ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/the-count-1916.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bcc1735b178014a37c15b0e8020b16a4f2a474c38fbad5b5649983b6890c27ae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37264
last-modified: Tue, 12 Nov 2019 07:35:43 GMT
server: cloudflare
etag: "9190-597214bb9a142"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PUoW89a8cAbjUpAadi%2F1emcEAa2%2BG6vsx4qoWcfZBTAZVdmGoompGWh74A6y4OLOi%2BMEcxZzA0P2QxFxuAQt29RQ8fnuKE4F1JupxSnvLrDZtNxU6RaTOOXHQ7ZEKemRLJb2TWnI%2F1Br8GL27olf"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee186afc90e0e-MXP

GET
H2 200 one-a-m-1916.jpg
eztvtorrentz.com/images/cover/ 33 KB
34 KB 109ms
105ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/one-a-m-1916.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65deb4ed184fc1cda7e15d648e0899b7853f451231d863a89e9df7719c9808dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 34170
last-modified: Wed, 24 Jun 2020 04:36:28 GMT
server: cloudflare
etag: "857a-5a8cd04f92c71"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0ZQeNt%2BG75k6%2FLKtJo38SPmn5Q%2FYuDzzs2GYZaibJAzjQXVcYhKTEpnavJLCN6%2B0XvFHMWuMa1qepIz7xTPdpx6QDD2%2FndtDMz38Ac%2Fq1HjxmtEuGwhslBRw8VCd44BPvDbZXrRu3F1%2F4q66NpVs"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee186afcd0e0e-MXP

GET
H2 200 intolerance-loves-struggle-throughout-the-ages-1916.jpg
eztvtorrentz.com/images/cover/ 31 KB
32 KB 79ms
74ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/intolerance-loves-struggle-throughout-the-ages-1916.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da9396deda4d19f742ff6e2ce52294030142636292f66ca02dcf1d714b26d7e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 32185
last-modified: Wed, 26 Aug 2020 13:03:50 GMT
server: cloudflare
etag: "7db9-5adc7736e2691"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c6PJigsZWMaYiqgUIImyh0oowpzEJIC3DacxSCguMaKlXnMT8Un3MILXsPTjbzS46%2BvzNiGJSbPWLfBZuBz%2FgWxsl9w6sR%2F5mpySayC3p2dTYlp4NeJnwpupatLc6Ts4p%2BW%2B1oeY0UQAziMfKm%2Fu"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee186afd10e0e-MXP

GET
H2 200 the-immigrant-1917.jpg
eztvtorrentz.com/images/cover/ 30 KB
30 KB 110ms
105ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/the-immigrant-1917.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c16e5c089c0646a08a1a72aa3c829e3fe9f1226459edb453b21c768649f8f474

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 30274
last-modified: Thu, 14 May 2020 02:59:54 GMT
server: cloudflare
etag: "7642-5a592e41c2e96"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WSXz6qnclKklqJ%2BGLlOuvHh%2BTuyRFrRb24Qf5fwxSzvN6NnV6%2B5k2xOkMhM3RsslSomL8rMmDsYzCDSiUkWAgwOhQEDdq%2BspbPl5cyCoTW2oEFnXoA84gW7E1HscKepV4teEA9L2BDbdRNO6Nx%2Fs"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee186afd50e0e-MXP

GET
H2 200 the-cook-1918.jpg
eztvtorrentz.com/images/cover/ 19 KB
19 KB 79ms
74ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/the-cook-1918.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 749f468aa9b333d83bad136ee7ede8f5e65e5176422cd38a9b46617bb442730d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 19566
last-modified: Tue, 12 Nov 2019 07:35:46 GMT
server: cloudflare
etag: "4c6e-597214bde6f1d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BngslKYemftarLEoAB%2B1JmYIENd2FLPCWscMeiMpoKwhWXr9xiJq3zx44OzaC%2BQ3z7tNTc2tqVSdF%2FlwwLrOiAIcrmOemwa%2BOcOF8IolCVioIcrUrMVvTYSk6odemPIhGbo%2Fk%2BVQ%2BO5%2FmYZE1uMg"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee186afdb0e0e-MXP

GET
H2 200 i-dont-want-to-be-a-man-1918.jpg
eztvtorrentz.com/images/cover/ 22 KB
22 KB 79ms
74ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/i-dont-want-to-be-a-man-1918.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76b685f30ee48269674cd557d24d035faf406e10955be8c84a9e2ed51fb8b846

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3230
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 22046
last-modified: Sat, 02 May 2020 04:12:53 GMT
server: cloudflare
etag: "561e-5a4a283007d65"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B%2FrNsIP7NaAwJ0hEmpEOB6FaM8omQ4dcZWAFQ2RFdKVlkeKc7cX4fB7FIXwZGtHL615cGyLsLarGsg7WHRYNxY27cc%2Bd%2FI1uj%2Fx%2Bin5%2FWQjbUbgayVEfvhIz%2BEY0n%2F0uJbSvbnMwkffhp4oGU0TP"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee186afdd0e0e-MXP

GET
H2 200 her-only-way-1918.jpg
eztvtorrentz.com/images/cover/ 13 KB
14 KB 79ms
74ms Image
image/jpeg 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eztvtorrentz.com/images/cover/her-only-way-1918.jpg
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4018779d9bba88b7cc0044e6de0e2bf645ab6142a2d3b62a28781f9f1709af8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3231
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13802
last-modified: Thu, 02 Sep 2021 11:14:13 GMT
server: cloudflare
etag: "35ea-5cb0148662fbf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VnFsPVUWCc2CUipB8HzwNTUjSlAhVjHCMgT5E8e0%2Fmn0sxdv%2FYrTzifB2TfsNEEJodN2S9ZNnTZ0Juq%2FffvBKjB5EU4D4fdV8LscopIrHM4Z3ZXbJ%2FGnZKfnoh8p%2F%2F%2FnfK5kuSgYEVC4XzP3LbGE"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6dcee186afe00e0e-MXP

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/ 82 KB
26 KB 108ms
43ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 844846
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 26646
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-1499c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vW9Uo%2B3YVtXvPCibi%2BY7bh6QJZ3wGi5Y9shjme6R8Fd9FkZ1aQwCwCXzhSyIu18osYxWuTiplQEtm2%2FndpqoHAqrkqKRfoSAg%2FZWw2jj8a6iOh%2FCrciydvOwJ2PlRE4ExtpEaMvul9UTGER%2FbYkCmaf3"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6dcee1863c3ad61c-MXP
expires: Fri, 03 Feb 2023 14:52:31 GMT

GET
H2 200 bootstrap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/ 35 KB
9 KB 100ms
42ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.4/js/bootstrap.min.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

267a83092a5fd6ec5fb746bce12d440abd37f1d649c072f653e17d0c800eb647

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 11989464
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8441
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:20 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04010-8c6f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Uxs4QaLxjVMizpneO32m0Frjb6adJ%2Bp0vtL6iNx%2F6cfx6xJGa6jmRime5Z5gNaaA6%2B%2FkNlvSbtv0eY35J6zsI3Eg7CNKamGCTcbzakpMO323pUkq%2BX1po721wl1e54ATbn8yYTTCg8h0vXUj7URYIsBf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6dcee1863c3bd61c-MXP
expires: Fri, 03 Feb 2023 14:52:31 GMT

GET
H3 200 typeahead.jquery.js Show response
yifysub.net/frontend/js/ 62 KB
13 KB 50ms
50ms Script
application/javascript 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://yifysub.net/frontend/js/typeahead.jquery.js?ver=18
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3643c4ebcb19a6b5ccb667ed329cbdbb20072fc76bedcc567da15258f420f8f8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6265725
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Sat, 08 Feb 2020 21:33:06 GMT
server: cloudflare
etag: W/"5e3f2912-f6b8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n1N97xJdkjIb4%2B1Qu2HrbOHIIuSAIzIIWoa0IlbPnaRe76TbTPMQGoG16%2BwpzLmcZlYGkxvuktMfLK39rKq4RrNbWm4smbDITlxBGAfgyPEYO16JalFCTJteGCmJTse%2FH8SbDaOYOtcX3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 6dcee185ed0e83a6-MXP
expires: Thu, 25 Aug 2022 23:05:51 GMT

GET
H2 200 owl.carousel.min.js Show response
cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.1.5/ 42 KB
10 KB 114ms
62ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.1.5/owl.carousel.min.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2bed74f256f5e731f2b2bb66cebc43963153aa0720808f163497aea15c69d4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 16712537
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9751
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:04:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf0-a6fa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RRqdROXmoVgYJ0PI3UpV55rUWuwE8U0KcEW8H2odQ8ARw4Sr1OMutUSdCkr%2B8pOeLYuaYyK9wAf7bjQ8ZapHyutZuy%2F%2F6qY0PHyLEskqYXVuwKTQfdRY4mrmD5e9ilbfuc5nocxwhy%2BMx5LfObA7kb%2BN"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6dcee1863c3cd61c-MXP
expires: Fri, 03 Feb 2023 14:52:31 GMT

GET
H2 200 owl.carousel.min.css
cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.1.5/assets/ 3 KB
1 KB 94ms
43ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.1.5/assets/owl.carousel.min.css

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a365a7e32ce97af977d8af302287db4e9e66b9c8a5b1a61f2128c61b5645cf12

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 13731248
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 754
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:04:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf0-bcc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1fIvVJfpyiDGmQyyQ4snzCiM8h0fZ4BvcSjP52bN8KIAeFyAbSjDN4X6tajhofEVt3fxCwk4sGN7hDTYtcqV%2FAChbO94Vc2JGbGmUr9Ea9STw26hwFOC0KGiUa1pdxtQAhJrbYDdr2ZkdYk7MorIjcc3"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6dcee1863c3ed61c-MXP
expires: Fri, 03 Feb 2023 14:52:31 GMT

GET
H2 200 owl.theme.default.min.css
cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.1.5/assets/ 1003 B
642 B 96ms
44ms Stylesheet
text/css 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/OwlCarousel2/2.1.5/assets/owl.theme.default.min.css

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

277b166c3c59f12e659bdf64d131dc21a35b32f658b79f4ba134d00d76960e76

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 13731248
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 332
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:04:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf0-3eb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JpTEzMLZnOfEQ%2FQj6JQgT2Gf3XG9wuRjzLecHI1XtBvmTvUTcss1fEsjBh9VT1W3g4I8bx6cNJO4R8DWYxTzKtpTxbDKzYr4ABfdrtDC9VfkqPMdyrE8CquW6Y1vEieQBN7U%2Fn68PJ9QvwOGzQ59fEpI"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6dcee1863c3fd61c-MXP
expires: Fri, 03 Feb 2023 14:52:31 GMT

GET
H3 404 bg-blue-main.png
yifysub.net/images/misc/ 8 KB
8 KB 108ms
108ms Image
text/html 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://yifysub.net/images/misc/bg-blue-main.png
Requested by: Host: yifysub.net
URL: https://yifysub.net/frontend/css/app.min.css?ver=18
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a88bb7ba583b3ef25f9e966bf6c0aa47b933e4b6851f5e8627a22c3a6425aeb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/frontend/css/app.min.css?ver=18
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BUc9PTN5SUXuC8NabBqIph4uvHME6%2FaXDM71x14kOpbCR%2FBks%2FFRmhrhAOnX6RIsZAHDhjozjAqJf4%2Bs%2BgZO3gGDj9eu9jh1pgExuxszpMfatfv9Sky2ha8dkgbluHTIVjmm4JpLxp9rMA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cache-control: no-cache, private
cf-ray: 6dcee185fd3283a6-MXP
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 44 KB
44 KB 29ms
6ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,800italic,800

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://yifysub.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 09:58:52 GMT
x-content-type-options: nosniff
age: 190419
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:43 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 11 Feb 2023 09:58:52 GMT

GET
H3 200 glyphicons-halflings-regular.woff2
yifysub.net/frontend/fonts/ 18 KB
18 KB 80ms
80ms Font
font/woff2 2a06:98c1:3121::7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://yifysub.net/frontend/fonts/glyphicons-halflings-regular.woff2
Requested by: Host: yifysub.net
URL: https://yifysub.net/frontend/css/app.min.css?ver=18
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c

Request headers

Referer: https://yifysub.net/frontend/css/app.min.css?ver=18
Origin: https://yifysub.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14312106
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 18028
last-modified: Sat, 08 Feb 2020 21:33:06 GMT
server: cloudflare
etag: "5e3f2912-466c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xzag8YXMncBv1BP4lKrMJS3iVKlxpvkcV9pBo7qh%2FveNCJkLDxOzsakkJVunpddBph0MkulqeT7TyiJe%2F07lhaYRYIOekMiVIB7d0rL71DBbexAgUeRAo0%2BnWHD4z%2FJT372On2np4KgvkA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
cache-control: max-age=31536000
accept-ranges: bytes
cf-ray: 6dcee185fd3783a6-MXP
expires: Wed, 31 Aug 2022 23:17:25 GMT

GET
H3 200 pubads_impl_2022020901.js Show response
securepubads.g.doubleclick.net/gpt/ 357 KB
120 KB 25ms
11ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a4fd9dc6db644313269ca0055f0cef11c1361c8879480f45393332ae2c8e027

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Fri, 11 Feb 2022 21:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 149938
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122359
x-xss-protection: 0
last-modified: Wed, 09 Feb 2022 09:36:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 11 Feb 2023 21:13:33 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 64 B
93 B 32ms
17ms XHR
application/json 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=yifysub.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7ebb32e3375dd958715c72984b675872cda3b2f11c7736f8184c6607dac81563

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 68
x-xss-protection: 0
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 36ms
8ms Script
text/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-20564943-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 4657
date: Sun, 13 Feb 2022 13:34:54 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sun, 13 Feb 2022 15:34:54 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202040301/ 287 KB
103 KB 51ms
36ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202040301/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2261953515587717&plah=yifysub.net&bust=31064742

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0e60179b62de9745e74b23690e330e85054050bd95d13337449307dda9ef146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 105918
x-xss-protection: 0
server: cafe
etag: 16698385270031495847
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220209/r20190131/ Frame 0C65 10 KB
5 KB 27ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220209/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Sat, 12 Feb 2022 23:38:04 GMT
expires: Sat, 26 Feb 2022 23:38:04 GMT
cache-control: public, max-age=1209600
age: 54867
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 27ms
13ms XHR
text/plain 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1540554141&t=pageview&_s=1&dl=https%3A%2F%2Fyifysub.net%2F&ul=en-us&de=UTF-8&dt=YIFY%20Subtitles%20-%20Subtitles%20for%20Movies%2C%20TV%20Series&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1940460417&gjid=927845950&cid=2094621581.1644763951&tid=UA-20564943-1&_gid=1774664304.1644763951&_r=1&gtm=2ou290&z=1777625316

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://yifysub.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://yifysub.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
439 B 65ms
19ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-20564943-1&cid=2094621581.1644763951&jid=1940460417&gjid=927845950&_gid=1774664304.1644763951&_u=YEBAAUAAAAAAAC~&z=740128210

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://yifysub.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 13 Feb 2022 14:52:31 GMT
content-type: text/plain
access-control-allow-origin: https://yifysub.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 215 B
417 B 50ms
14ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=yifysub.net&callback=_gfp_s_&client=ca-pub-2261953515587717

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202040301/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2261953515587717&plah=yifysub.net&bust=31064742

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

b3a3b33f2a0164ab206f687fe6865fb6177d686260fb74c51c90bbbc38e5d9b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 202
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 54ms
32ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=yifysub.net

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 54ms
33ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=yifysub.net

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 39ms
38ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fyifysub.net%2F&tn=NAV&cls=navbar%20navbar-default%20navbar-fixed-top&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 95D0 38 KB
12 KB 241ms
226ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&adk=1812271804&adf=3025194257&lmt=1644763951&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C8%3A64%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fyifysub.net%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951122&bpp=4&bdt=176&idt=132&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&nras=1&correlator=119107143287&frm=20&pv=2&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=143

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1b4687d76a7a4d2df3705e8d5896a5236ebb53c4ad3bde497bd76a833a8adc34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
content-length: 12441
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 14:52:31 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BE46 124 KB
40 KB 221ms
219ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=4747580367&adk=1949448543&adf=2725398064&pi=t.ma~as.4747580367&w=883&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=883x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951126&bpp=3&bdt=181&idt=148&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=128&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6QS3J32Nga&p=https%3A//yifysub.net&dtd=152

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67e4af7c5be86a6bfca07f25b4ecb8f4a6ba48f7e1eebaf0b6c418e90290a1f5

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CI6uupj3_PUCFc7a7QodlrcKMw&gqi=LxsJYrCPEu-A1fAP4PKMQA&layout=/sadbundle/%24csp%253Der3%24/15682089182182342286/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CI6uupj3_PUCFc7a7QodlrcKMw&gqi=LxsJYrCPEu-A1fAP4PKMQA&layout=/sadbundle/%24csp%253Der3%24/15682089182182342286/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
content-length: 40790
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 14:52:31 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C1D3 17 KB
8 KB 262ms
261ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a8bde3ddebf0daefcae11a7934d6996c2d417f6745b88adb19ab61f380a124e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
content-length: 7963
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 14:52:31 GMT
cache-control: private

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 51ms
29ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20564943-1&cid=2094621581.1644763951&jid=1940460417&_u=YEBAAUAAAAAAAC~&z=1898329556

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 52ms
30ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20564943-1&cid=2094621581.1644763951&jid=1940460417&_u=YEBAAUAAAAAAAC~&z=1898329556

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/ Frame FED0 209 KB
85 KB 40ms
10ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/index.html

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

67042917ee5c2433d37dc95fa2114aec7d8e8dfd2360bbd72096f5b6393f4899

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Thu, 10 Feb 2022 16:45:11 GMT
expires: Fri, 10 Feb 2023 16:45:11 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 02 Dec 2021 13:24:27 GMT
content-type: text/html
content-length: 85644
age: 252440
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DCC5 0
0 79ms
79ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CxG0CLxsJYs7aEs61tweW76qYA62_tfFn9Nq2kOAOrqGr2roQEAEgy9eWUGCV4pCCoAegAdiFoOgDyAEJqQLACNMsjQqzPqgDAcgDSKoE2wFP0LuYvqBsSxF0OtUve4nkCXlwiHE82Y0P1I4vgshB-nkJ3IYjZXVbdGwRHDhYdIdoZWi9YLYCpsrS8UDQGLFEzJmMrJHdrApw_0vSrHeAZ9_TuoEgPsbDaCRYZZvchci0Xqc2NTtUn6Roe3veCRYlRlOf9ExlN19-KDe1nbIMxA_w86C8KVan42ScDUemtJxl_g4Nzv5wWRf33_Bb3afqcmS0L4cNyiosxU6Hud170CWRV5llaLzpmAeVAHdTTGhxgKb_qQ8mKvRblQfOgkuzJekwQgmM7OSNXYvABOy_psvcA5IFBAgEGAGSBQQIBRgEoAYugAeQ-t8XqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQu44D0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBmBYBgBcBshccChoIABIUcHViLTIyNjE5NTM1MTU1ODc3MTcYAA&sigh=tIuD4WTdSnE&uach_m=[UACH]&template_id=419

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=4747580367&adk=1949448543&adf=2725398064&pi=t.ma~as.4747580367&w=883&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=883x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951126&bpp=3&bdt=181&idt=148&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=128&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6QS3J32Nga&p=https%3A//yifysub.net&dtd=152
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 13 Feb 2022 14:52:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame DCC5 19 KB
8 KB 34ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=4747580367&adk=1949448543&adf=2725398064&pi=t.ma~as.4747580367&w=883&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=883x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951126&bpp=3&bdt=181&idt=148&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=128&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6QS3J32Nga&p=https%3A//yifysub.net&dtd=152

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:24 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame DCC5 2 KB
1 KB 35ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:40:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 717
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:40:34 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DCC5 124 KB
38 KB 41ms
21ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame DCC5 15 KB
6 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:46:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:46:05 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202040301/ 150 KB
54 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202040301/reactive_library_fy2019.js?bust=31064742

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c23d0afeffcaaa5c10a6f04a2ee268fc23c47525aedb0a18c176ddd2236acef2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54883
x-xss-protection: 0
server: cafe
etag: 13953601749066552407
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 47ms
33ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=yifysub.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 45ms
31ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=yifysub.net

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A05E 89 KB
33 KB 383ms
381ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=317821684&pi=t.aa~a.3087911199~rp.4&w=883&lmt=1644763951&nsk=a53385ba&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=631&idt=-M&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280&nras=2&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1241&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=mugYgwaWgs&p=https%3A//yifysub.net&dtd=10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be10cca1238ed58d1cdbb6f90cc6f8cc8c2e72a2224bea4d86e469e655facc74

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
content-length: 34053
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 14:52:31 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C240 32 KB
15 KB 567ms
567ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52f9e435f1b43ab5e8a6587ba75c212535f965e75a0df00b79dbe8e9b5a5ce6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sun, 13 Feb 2022 14:52:32 GMT
server: cafe
content-length: 14845
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 14:52:32 GMT
cache-control: private

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5B59 143 B
163 B 6ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=4747580367&adk=1949448543&adf=2725398064&pi=t.ma~as.4747580367&w=883&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=883x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951126&bpp=3&bdt=181&idt=148&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=128&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=6QS3J32Nga&p=https%3A//yifysub.net&dtd=152

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Sun, 13 Feb 2022 14:03:09 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 2962
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame DCC5 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b5ace73eb2a134c75d87179bcd3f011545d1784769af5b75bb3096b1b5f4c2b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8D3B 624 B
297 B 19ms
18ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY6_vtvAEwAQ&v=APEucNWkifLCnWjMT6j3eUDuTfkae3Dhl1Dq-3SjQh0QS1PyaZ-SthCHcoFwwrewDgKW9kh81-YQrgLOWIqsspdTN_4Q2i-n4XHH6Y8h0jXY178WELqmVj2yIzw6qUhHL5XNfaRvsxMer8DLKdimyH2taYNXt4GJKEp-e-EYafIoUi0l721_rl0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 207A 86 KB
33 KB 80ms
79ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AeFTIxFPKF4s7KUeQyzlXS3b4Oi05oK-BGmgLdq8Z7rrRa7awt_8QDOgnefkhQgMyMG8WAOYJPKn_b1xjAmJ_q8PqKnD_9gFGVIlhOOXf3DCgm3ypdwUvj_oEl4G7PiBdADvJtcAbIQsxQGiD1XtfgvmfjTQ&dbm_d=AKAmf-DgOko20thcVFZesy1Gk06e7JBy2prVGSV3Aqg1cZv2AG8WV3ogS-HAGy_CNXFc1DzlffPRiFPEjNLyf_CnlY5aBChb4TSS7iOgh4_u2_3ha5fY9M86QbWY52Qmi0rlJpRETgwimISIl2smc6I-jk8p7Fbek7gDZsM3axAJK9mn9FCqrJXC6ckElwgtGXaE06R4SwBTFtvgLH1HHFO4vfI6IuQs86ulmcosKrgbskGvfnq-JSApSnaMQXW7I80rK0zIZ93I5zv6dGHNl1eDdhxXIlKSCKXAPlaM-yQo2PQh7roRhCYCYUhVJRFoDxBVuFOf2Ga3Z9CxrjRaN-FHTWPcQHtLCT0EDB_kXcPs-PZfpDoVo80t0eBQntRwlMN8k3dD2dZPxyDc2egKnt9DHclculFT8WmxVGI9bGWLRsB7SYskk25-robGBsxTP3Y23Vbjx3RwNgFAEpovrM-7tP-G8vPNUihE3pN70DtTcDsacPp7G-WwPIx7tCB13AflogT7IT8Y1vz68J_xbBwyL0SgXTF70UUlsNQsk7ZT7vRU6pQVOkZ_TL3OY9rgacRZy01ThRtu1d1fbPxWGtr-6VdEQZmcsbM1K0dFYq0fgjK8lKy11MpziR6RE9-PoXJz8cZoh_oKdQSl3erFJBc6CD_5ISSfuGfV1ZdbFCf5CImEzokzjrwGkew25NOc3sRbKvUwdGYvkp4B7lXwlbeI2LR7sRuAz8h-HiyzO2PZgSQWtNyyx1kxecXFgYwsBA11rcCeLzU3LP-ClDR3Xzhw8NRBrHmyiIu8K1zN9QRc4wFk8nUrXKRfgAFy0YtIdNT7A5UxZUz7AULKNVpgJYPU2x5UraR_JPBqWiJdvsLbWH64b4ljYguyZxVzyNQIwjAm-LAk0lEns9idcHCwh0PQv9oaCjk_jTc28BpASkfLPH2Lc8qlYrL4uQqeUYGWKLCZGBur0eux6EqjdqJQC8uivw3aXsi3oc3zC9aeDzmWMskEWlzDyB_6nZkzcugV2nunwknh6SzzxOa9wbwBytaDxvfrH8Y40ymJDv3M7NRSixGfWCntG2GLTimKHvQT3dqR6lD2LlP5B63oG0G5nxc_VhKV2eX4NqnYM1EmBjK7nF80EjIy9p1l9N82Kg9JhNGJmmU8T9LYAWoZG_Z--tS1JPS5RVIj7xEaNxcarri0XdRGhJVL8-C8MILpVbK98YTt-bFOqyfBna9nzlSyJCWNBiSRsD80T8e7Uyf0QoKxn6l1-iePTKAsE5ovD1lLI61qD9SOFZW8VWA5acgqEo4Gak7uJNtmh4dZW3_i5y4kATkWa0XFqxi3RsTL4zRNnwUgAM7Y8IRv1y4gl3s3JJ3bjQTj2jbqaZVWDXAcMrtjy2TA0ljGNrTAO8ibOj7VbpE2DI6UENONnTDfvZDsyuyaBYS4aWLICYa-d9uVOgi7O_MoTEdL53vAgWes9Qc0ZOZ7mCM6itCWTqD2SDOKQzRdZD4eT14wvIsCyRkQ6Fp6yVCafEoI9zXZ_ZuqtXCCFi_nWPudJZHezBxTe4qzw2SpHNpgYlSHALujehD9kk6aC8Oms0XppeGkciG5pfWGy5OG8tk-txhjRpTeXEfN1qhJCOuhNzmQg1puKNdot5aAzXkXKnWVx8e0evr0tGMdUbAWOrzy2S1LlyUIWzOVURzacqkhrmkqmbSmoF22yFXbTC4ChSmtdeYcmq5L9Jn0zL7BlQWbmQuYzgP6rvFVPh7Fchc3ywMblXRcTiFKd1YFMZt8WSzIspfiGCYXfRlMzw0I-CT3xaLFRCiEsRTqmzO4aSErrlSSa0x2HBG-jWPLvH5pm5dpiWZGzm6w5ENJpeC4xw_PqsjuPCmyq2XWRuC8BxD8lRCDUk-2e8a8gwDwO2Vo2xGA5bU5BEgFuzyU4mkKI72lvMgs4fwCJk-7s0bc8mQd-xmi_D0QWgzfM66NQEORbVYfjwluuQBs52M7xrpUp0pzUBXN9fOiKoBYe2v3YSk4ugAdLR4mqyG6QeNz0gkCJ8jRbwRVCcUKE9oYbaXIHZrJdc2rN_b9l3vcGr93MN56Ff-RDR2HO16Gp5-xBNK7UqYa8omnOaiR-Z89huO5NyPBzhPLUSucO-eDAWEHksF-CoXdyuMwcddKnZRetq35LtZeI6a-t7okNCpHFH4RF6mP3BzDnSW9SeK9X3YP6LmLgHkWZ5Sdx0wjw8fivnOTDTIPwzGJhBa60H4cvuwafsXbs3bftrCkVoGBDK_Vx1TX3wQZuuBdnO0y58S4oLq9GfPQWWSX88yo75xuhfQI9JMO_gkUcpkYYm5LSkvKB62xGcSBxCZ8UQr0BrJFHV9apfujZpqI6NfQTjytrepYHPBXMk8S86g8QwALn7jlkOM_ptuhl3BLSa_DowX9BNkZzdCrFAacRUSHhWZsY3_r0qRpMuGOQpVV3esP5czrdWuQ80kmzBsacKpuQw_oCL7rhyTEPVUx79D3FMKIbmHQEiUMW5zCMwyOirid4RApCAIwq-zrkE6d88iMQ3djIjfqfDsjgDcJOQfSr5Zi-yfNfakPhvSf9BLrw3DNsdl8EVUniZ8cd0gdD_BDeFhFtLjy6kxeQ2oXEMRyW4Sp8n4vaExF8aUpBa_nKCsYIQHsmSFfu0c07wh_ibWTkavNlwLIjedgdb48jP0vNZxtQU0yaNldrrjoY4Oon1fKzmA3lQDnTCjwyhh7OTf1AuMYgup7tGVHu4AU2NOttfRCEHXJPbAJy--zRNi-xK3EKTqz1fauVduLs579MJqzZXMJ3IAEBZ6i0xClOKvmCC_hjOfq9f0ZoIZkk0byBdbI6fQroJpkzl9imEe2m7Lrz-bb16GGhiMpglhGgKHlntJycv4rbS_U-Hoz&cid=CAASBORomZg&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bbfdd8fc369f4e5ef9175c6e07dbf6006b337b168270c6610b0c7042f7754b1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34043
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 207A 2 KB
1 KB 22ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:50:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 142
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:50:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 207A 124 KB
38 KB 33ms
19ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 207A 15 KB
6 KB 21ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:46:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:46:05 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 207A 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AsJO4HRC8xYLeJF3Wl_CZHjjoAYJ3c7MB4sOhmF9ynIGdQiCuVJxQF6t9fBblBmb3y64EoKOjYsz6iFN0gI4Lj-z1UlB45gq9P75YiKlhtuxZLgPs

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/ Frame 3673 10 KB
5 KB 6ms
6ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Sat, 12 Feb 2022 23:36:39 GMT
expires: Sat, 26 Feb 2022 23:36:39 GMT
cache-control: public, max-age=1209600
age: 54952
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame FED0 16 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55444
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 13 Feb 2022 23:28:27 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame FED0 26 KB
10 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 16:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81532
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 13 Feb 2022 16:13:39 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8D3B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDgKRcr4M5Aok2duG__yUxw&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDgKRcr4M5Aok2duG__yUxw&google_cver=1&C=1

43 B
1014 B

54ms
53ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDgKRcr4M5Aok2duG__yUxw&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY6_vtvAEwAQ&v=APEucNWkifLCnWjMT6j3eUDuTfkae3Dhl1Dq-3SjQh0QS1PyaZ-SthCHcoFwwrewDgKW9kh81-YQrgLOWIqsspdTN_4Q2i-n4XHH6Y8h0jXY178WELqmVj2yIzw6qUhHL5XNfaRvsxMer8DLKdimyH2taYNXt4GJKEp-e-EYafIoUi0l721_rl0
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:31 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 14:52:31 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:31 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDgKRcr4M5Aok2duG__yUxw&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8D3B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YgkbL-A.q9OboAqVsWq2SAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDgKRcr4M5Aok2duG__yUxw&google_cver=1&google_hm=2

43 B
1014 B

37ms
37ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDgKRcr4M5Aok2duG__yUxw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY6_vtvAEwAQ&v=APEucNWkifLCnWjMT6j3eUDuTfkae3Dhl1Dq-3SjQh0QS1PyaZ-SthCHcoFwwrewDgKW9kh81-YQrgLOWIqsspdTN_4Q2i-n4XHH6Y8h0jXY178WELqmVj2yIzw6qUhHL5XNfaRvsxMer8DLKdimyH2taYNXt4GJKEp-e-EYafIoUi0l721_rl0
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 14:52:32 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDgKRcr4M5Aok2duG__yUxw&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8D3B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPB2C8Me_wvvCbkWnJiwqEI&google_cver=1

43 B
1004 B

62ms
36ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPB2C8Me_wvvCbkWnJiwqEI&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY6_vtvAEwAQ&v=APEucNWkifLCnWjMT6j3eUDuTfkae3Dhl1Dq-3SjQh0QS1PyaZ-SthCHcoFwwrewDgKW9kh81-YQrgLOWIqsspdTN_4Q2i-n4XHH6Y8h0jXY178WELqmVj2yIzw6qUhHL5XNfaRvsxMer8DLKdimyH2taYNXt4GJKEp-e-EYafIoUi0l721_rl0

Protocol

HTTP/1.1

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:31 GMT
X-Proxy-Origin: 217.64.151.28; 217.64.151.28; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 024d9582-0827-4cd4-aa23-ecaa2aebc856
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPB2C8Me_wvvCbkWnJiwqEI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8D3B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMjAxMjI2ODA4ODQyNzUzNQ%3D%3D

170 B
188 B

47ms
32ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMjAxMjI2ODA4ODQyNzUzNQ%3D%3D

Requested by

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:31 GMT
X-Proxy-Origin: 217.64.151.28; 217.64.151.28; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e3877220-f864-460c-b975-8140af49dd82
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMjAxMjI2ODA4ODQyNzUzNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 318F 640 B
316 B 17ms
17ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY2dqVwAEwAQ&v=APEucNXXxCezx7UQuSJnukulMLV7lqCwTwIlY506CLoSSU5RZDnKOyG0ZrQ7qN12qFeq75jWelXJ2GmjMJ0f4lOk9O_cPzSUIK8Jz1XoAMf4CVpqnkPMgjxdeGaIlghlxJBM9M9S_QsuPw1YI7YGFAAmeZciFYn2_27dmCylMD6fTD7GUl7opac

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0874 85 KB
33 KB 74ms
74ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMjQQuK1C4xwYzURdFRLSBK-WSs1mMqm4cZoCxsloKttekUpc0eC7-Qr_kEzlXXv-5kEpHwX4iBvQT4WlMLOPZVLUWDjGtFcvrCxvKJKQPxdRNCwPPHSNTNomMJeM2bMyAvorQXTzQIzseJ1I6WkKXokZLDQ&dbm_d=AKAmf-AaBMGdJhZjLot6i_8FvuSTQjzS8tdgfIkphdk3-Xgc9ShjwVGjFAgyy8wT46GSPohsAZCVRBsL81UpcdZ54QSx-qngUtSay8n96IxfJNKChLwtfEyq_cAvKq8Ty4DfwK3a9i4PFkkBTnVJkigFAxC3PkXFUhlDOgk418PxGGQlB4bcyKYq_Tdi_OwrD1kuJxoU3qbOnVY0QRPLL79nSOgXW8hkODd321sJ9ojNDN9DyIKbJTjR1fzJFopaiOz_pgiw8_4S9kTPcNPu3aYHjagXta6YiyOA4vN0iBM_QadtcLhqu__xP_UmD0jMxyEwb9Xa1Gr55Q7C1JfpqRSMUUbsl-vitXiAuuxvTwYBYBDkbV9aoXXPlKlNPCm0XEVWtr3GJDe9WXMn2T7-LJwcDHWCSz4LXEIUx7p-pVsv-aXMZMjRselKlskUrhoRia0ejzbPIMh3XOR69VGmZgMcj8a3h15zHuPYUEXHkIhRCgVF57GrNHhDftVeNEh2uQPpawGzWpxuEJE8whLsqXB0jLNxjCsCeS1HX4bu7zYg1cf2U6it277sHPO0FgzqpWi_mYDIIXcmG7SqHn7VjaACkWXQljntvX6hVbQEsKUB1fXkrE3oNKQunSm0fCyumhVB3DEE3CWTIEHANxnsX2bzcAA3h5Npw6EkUuJbuZSyh-LLUNqqQ3TwQjnsKoEf0SAOztbFeqCj7HOaSwN4s9xDETZ-ehn8CEvtpkOAJ58zkPUW6lu1cSM00JGPgxSZT0mSsyFW5iJDxnNo2d_1_O4YMJ9IXKoDypsrHrs9nvwL7EUnp3DzE_JLrfd-rw4V9ZtJcQXW5YiAukKkwpmkcVvvdb5ypgpnTtYBUcI50EbJON0Ej785uEjOXc0ZLnmXiZLa9mLAno0NWfzcFuvsRVgxjzQ3q5kIyPA3mM62eIdhSwofPZYfFxqymiz7N8ghTZ0Jg8o1zm75J1v7aSzEX2to0CWsd9RdkQm9YWnxAIO_uaxCvBbOWr6y15Nx1GNXhQ9JlcIZyk10fy5OveNOFSy_0ApxkXa9Z2kTMAHkuLAtzpcS-FPgDRQHK0pfCTMLvFpBO36A5yshfmBZMSPTP0KRyxeS-3-ByXe1CKrDQvM6oa9cGp7SR0PNI4rFAvFyzP86AQtfaMK1D80ZdqDrBR8nm8TPalbFwTwolc9wXLO8s1yrtynltC5LU46yKpW22Heg5XJ7bxNMzJCVccYLWbiOPEAuNOrF6xBbNVv0w_AW0UkgYZemyyHxrxmlp4fYl4tYgD5J3xCISRqVxIkFfu6XhiUAOt4zcldHKalrlvIZVWkwCyYmdIycrhaaPVK9Ar5Ns-Tzk4pOl-O1fVnD4ma4i-o45Ywes84XcR6SPGQQaZi1kqvJvKa9JlSSQ0AeAb7xpi-1CoYmjJK873tJ0WOccMSMTXzqwY1F6icyHUINLdAx6MKpUv9C4k9LaiptC_k5mAgEJCkjek6anVTKBsQuoee1XUtldllxfP2WAUHRWGYK9myX9D68yfJP6jlRHCgPzNnbfcAW1zNbzeImR7M_mGMbQ4AgCPQpaaQlGSL2CYTENYF8Ak9R8U2MyU5NoWkntadykBapZee4_FYnxij41QkYh3-luh_tcFnZaX3-G2jXLEstDJTBJinyIhdrkgVETFLw3HiKFbYY4bRamv2lp29SfienbPcXPIpsk6s7NaOmT3jO4NdALkC5zGq6A7ShstvSVNw60noB9KaMOjGLwwNIRh3M7txHElT2jh5-eqBGMj31kjXi_USwiF3PbOxSDGEJ2JRn2ALDq7YDiPGC8xpSeKfFXtS9tvkuISC4J4usKAKLhOwezsrBr8b0hQs-EqBEoOlqeU-nkZzYpyGGcUtyL_IZoRGw7H6mYrXVu0x2BR8uoEkEimK7Kj7feFVU8tEKZB1bL5my4GjWa1s3j-1PbCuBtvvdQ9aTSMlG_NwLuldncngTSnhXVLQJboRVID8btU9jdKWZRTIq3oC5Enf-aWhXnQOe58x9HKs-N95_dxA8MjkWl3HMVBd59OFsJH7cK9qxxZNUDrHU3mpb26-4vM4TcpZZapsx5W7ZQA-9A2NUOjZuDXGkVY6qUMYo4LfaBswD3t8YylSjjcWllMVvmgRYosH-Xre7VkzwSLuypzsTDliWVXXeHidPYdXqxdpKXlJRhR8qXdRGnORArbYQh_skHBzWeNHw_F0vLQ2Uvw-4yYysaZV6sgOj6UHg1UuNEiRh62gG-pXTMU7Y0Fj8baJYggN1Mh7Z8Y3OinSV-kv-H-EMBV1F5Yt1jiCgQ7wuUF3ifFIrvjneNvwVdi7AI6nBEZt84xHH8J0MUWkKvPLQneEd349sdC9c9Zl1JSymBWqtbObiyVdTI4VmBY0Rws5YVrXxajSXflw7Q3FD7BvDVkwaO8uXRwXHTnb7zfFVFD5yQN2GcOxQVddaJ7F_NrAedTl6BY2doWU3wCP3s9vkQQitYe0YNmx7Vc4ZVClsRSW1Iwr9G1pmDBVwpvVC2cTn-T4E1wW2mJ6teBRR1-FAx4OHc92_tEB5NMlFo_8PSnygLdnXyEX1q7E2XUWczHF6bHye0JftxUfY704P8T6Fy0bpsmWbvJ6EkC-G1lVzPt1usFwJyYbz35Hl98cRKXPn0eHAB9-cJn_84cz42sFPk2kNIPaSHhiUQr9nX4jHgxwT0AmiSj2VWBeVnqDneXzGUqZUxRFmJrQQPVfQIKZ1rxGprn6lpr1NXfF27kNK7v0sP7hcL_o-PSpqddYJISjO8ubZG7Yjh1nc4eCwHx_JJ6NF6ItllzKiLpV6Zf-zqGROs5Ur9Ov1zNNRBGjxl1gzOe9mjob4MjS7V6GnRotDJzlb9gLd2AbvfssaOb0Uk34-WyAWsRSOgFolu4b_53q7YQ&cid=CAASBORo6nA&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a10d60313b9288f9ef4d1c3cd35a41802710738b78ba219110b2c32f8fb11684

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33970
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 0874 2 KB
1 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:50:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 142
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:50:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0874 124 KB
38 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 0874 15 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:46:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:46:05 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0874 42 B
63 B 44ms
43ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CByg_pGFr6zCi_FOfMou5iqKgjSSp50bT6mV8X6pd6lUyzEokLva6zurFHIxe9YI0j7vz-tdSApp5m1krlj8VlKL_-iHrLq_3a5q0QpeHH5dJLoPQ

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame FED0 41 KB
41 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67e050fa430a598965efa83b430a7eaa470b4187fce0a65b70dd3cb34dbebcd3

Request headers

Referer
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ Frame FED0 46 KB
46 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af4fa13d9c2e8d0e1449708b04a3bbac146094c0bcd926b1e15833223699b834

Request headers

Referer
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5B59
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

67ms
66ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 14:52:31 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 13 Feb 2022 14:52:31 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/895631/58886992/ Frame 207A 231 KB
76 KB 179ms
57ms Script
application/javascript 34.250.149.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/895631/58886992/skeleton.js?ias_dspID=3&ias_campId=25570486&ias_pubId=pub-2261953515587717&ias_chanId=1&ias_placementId=15519062596&bidurl=https://yifysub.net/&ias_dealId=
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.149.102 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-149-102.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3f7ed73d0184a5c2ceb7ed28133b32d062a3d1fc75793462455b1a953b9a7728

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-server-name: app19.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 207A 106 KB
38 KB 81ms
7ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53556
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 23:59:55 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame 207A 8 KB
3 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AeFTIxFPKF4s7KUeQyzlXS3b4Oi05oK-BGmgLdq8Z7rrRa7awt_8QDOgnefkhQgMyMG8WAOYJPKn_b1xjAmJ_q8PqKnD_9gFGVIlhOOXf3DCgm3ypdwUvj_oEl4G7PiBdADvJtcAbIQsxQGiD1XtfgvmfjTQ&dbm_d=AKAmf-DgOko20thcVFZesy1Gk06e7JBy2prVGSV3Aqg1cZv2AG8WV3ogS-HAGy_CNXFc1DzlffPRiFPEjNLyf_CnlY5aBChb4TSS7iOgh4_u2_3ha5fY9M86QbWY52Qmi0rlJpRETgwimISIl2smc6I-jk8p7Fbek7gDZsM3axAJK9mn9FCqrJXC6ckElwgtGXaE06R4SwBTFtvgLH1HHFO4vfI6IuQs86ulmcosKrgbskGvfnq-JSApSnaMQXW7I80rK0zIZ93I5zv6dGHNl1eDdhxXIlKSCKXAPlaM-yQo2PQh7roRhCYCYUhVJRFoDxBVuFOf2Ga3Z9CxrjRaN-FHTWPcQHtLCT0EDB_kXcPs-PZfpDoVo80t0eBQntRwlMN8k3dD2dZPxyDc2egKnt9DHclculFT8WmxVGI9bGWLRsB7SYskk25-robGBsxTP3Y23Vbjx3RwNgFAEpovrM-7tP-G8vPNUihE3pN70DtTcDsacPp7G-WwPIx7tCB13AflogT7IT8Y1vz68J_xbBwyL0SgXTF70UUlsNQsk7ZT7vRU6pQVOkZ_TL3OY9rgacRZy01ThRtu1d1fbPxWGtr-6VdEQZmcsbM1K0dFYq0fgjK8lKy11MpziR6RE9-PoXJz8cZoh_oKdQSl3erFJBc6CD_5ISSfuGfV1ZdbFCf5CImEzokzjrwGkew25NOc3sRbKvUwdGYvkp4B7lXwlbeI2LR7sRuAz8h-HiyzO2PZgSQWtNyyx1kxecXFgYwsBA11rcCeLzU3LP-ClDR3Xzhw8NRBrHmyiIu8K1zN9QRc4wFk8nUrXKRfgAFy0YtIdNT7A5UxZUz7AULKNVpgJYPU2x5UraR_JPBqWiJdvsLbWH64b4ljYguyZxVzyNQIwjAm-LAk0lEns9idcHCwh0PQv9oaCjk_jTc28BpASkfLPH2Lc8qlYrL4uQqeUYGWKLCZGBur0eux6EqjdqJQC8uivw3aXsi3oc3zC9aeDzmWMskEWlzDyB_6nZkzcugV2nunwknh6SzzxOa9wbwBytaDxvfrH8Y40ymJDv3M7NRSixGfWCntG2GLTimKHvQT3dqR6lD2LlP5B63oG0G5nxc_VhKV2eX4NqnYM1EmBjK7nF80EjIy9p1l9N82Kg9JhNGJmmU8T9LYAWoZG_Z--tS1JPS5RVIj7xEaNxcarri0XdRGhJVL8-C8MILpVbK98YTt-bFOqyfBna9nzlSyJCWNBiSRsD80T8e7Uyf0QoKxn6l1-iePTKAsE5ovD1lLI61qD9SOFZW8VWA5acgqEo4Gak7uJNtmh4dZW3_i5y4kATkWa0XFqxi3RsTL4zRNnwUgAM7Y8IRv1y4gl3s3JJ3bjQTj2jbqaZVWDXAcMrtjy2TA0ljGNrTAO8ibOj7VbpE2DI6UENONnTDfvZDsyuyaBYS4aWLICYa-d9uVOgi7O_MoTEdL53vAgWes9Qc0ZOZ7mCM6itCWTqD2SDOKQzRdZD4eT14wvIsCyRkQ6Fp6yVCafEoI9zXZ_ZuqtXCCFi_nWPudJZHezBxTe4qzw2SpHNpgYlSHALujehD9kk6aC8Oms0XppeGkciG5pfWGy5OG8tk-txhjRpTeXEfN1qhJCOuhNzmQg1puKNdot5aAzXkXKnWVx8e0evr0tGMdUbAWOrzy2S1LlyUIWzOVURzacqkhrmkqmbSmoF22yFXbTC4ChSmtdeYcmq5L9Jn0zL7BlQWbmQuYzgP6rvFVPh7Fchc3ywMblXRcTiFKd1YFMZt8WSzIspfiGCYXfRlMzw0I-CT3xaLFRCiEsRTqmzO4aSErrlSSa0x2HBG-jWPLvH5pm5dpiWZGzm6w5ENJpeC4xw_PqsjuPCmyq2XWRuC8BxD8lRCDUk-2e8a8gwDwO2Vo2xGA5bU5BEgFuzyU4mkKI72lvMgs4fwCJk-7s0bc8mQd-xmi_D0QWgzfM66NQEORbVYfjwluuQBs52M7xrpUp0pzUBXN9fOiKoBYe2v3YSk4ugAdLR4mqyG6QeNz0gkCJ8jRbwRVCcUKE9oYbaXIHZrJdc2rN_b9l3vcGr93MN56Ff-RDR2HO16Gp5-xBNK7UqYa8omnOaiR-Z89huO5NyPBzhPLUSucO-eDAWEHksF-CoXdyuMwcddKnZRetq35LtZeI6a-t7okNCpHFH4RF6mP3BzDnSW9SeK9X3YP6LmLgHkWZ5Sdx0wjw8fivnOTDTIPwzGJhBa60H4cvuwafsXbs3bftrCkVoGBDK_Vx1TX3wQZuuBdnO0y58S4oLq9GfPQWWSX88yo75xuhfQI9JMO_gkUcpkYYm5LSkvKB62xGcSBxCZ8UQr0BrJFHV9apfujZpqI6NfQTjytrepYHPBXMk8S86g8QwALn7jlkOM_ptuhl3BLSa_DowX9BNkZzdCrFAacRUSHhWZsY3_r0qRpMuGOQpVV3esP5czrdWuQ80kmzBsacKpuQw_oCL7rhyTEPVUx79D3FMKIbmHQEiUMW5zCMwyOirid4RApCAIwq-zrkE6d88iMQ3djIjfqfDsjgDcJOQfSr5Zi-yfNfakPhvSf9BLrw3DNsdl8EVUniZ8cd0gdD_BDeFhFtLjy6kxeQ2oXEMRyW4Sp8n4vaExF8aUpBa_nKCsYIQHsmSFfu0c07wh_ibWTkavNlwLIjedgdb48jP0vNZxtQU0yaNldrrjoY4Oon1fKzmA3lQDnTCjwyhh7OTf1AuMYgup7tGVHu4AU2NOttfRCEHXJPbAJy--zRNi-xK3EKTqz1fauVduLs579MJqzZXMJ3IAEBZ6i0xClOKvmCC_hjOfq9f0ZoIZkk0byBdbI6fQroJpkzl9imEe2m7Lrz-bb16GGhiMpglhGgKHlntJycv4rbS_U-Hoz&cid=CAASBORomZg&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame 207A 24 KB
9 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:22 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 318F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMTEHSP3lyoVY8S7PS8pi8E&google_cver=1

43 B
61 B

26ms
17ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMTEHSP3lyoVY8S7PS8pi8E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY2dqVwAEwAQ&v=APEucNXXxCezx7UQuSJnukulMLV7lqCwTwIlY506CLoSSU5RZDnKOyG0ZrQ7qN12qFeq75jWelXJ2GmjMJ0f4lOk9O_cPzSUIK8Jz1XoAMf4CVpqnkPMgjxdeGaIlghlxJBM9M9S_QsuPw1YI7YGFAAmeZciFYn2_27dmCylMD6fTD7GUl7opac
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMTEHSP3lyoVY8S7PS8pi8E&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 318F 43 B
305 B 56ms
16ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY2dqVwAEwAQ&v=APEucNXXxCezx7UQuSJnukulMLV7lqCwTwIlY506CLoSSU5RZDnKOyG0ZrQ7qN12qFeq75jWelXJ2GmjMJ0f4lOk9O_cPzSUIK8Jz1XoAMf4CVpqnkPMgjxdeGaIlghlxJBM9M9S_QsuPw1YI7YGFAAmeZciFYn2_27dmCylMD6fTD7GUl7opac
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 318F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEJErl9uy28Kl6skugQmqI0g&google_cver=1

23 B
172 B

200ms
58ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEJErl9uy28Kl6skugQmqI0g&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY2dqVwAEwAQ&v=APEucNXXxCezx7UQuSJnukulMLV7lqCwTwIlY506CLoSSU5RZDnKOyG0ZrQ7qN12qFeq75jWelXJ2GmjMJ0f4lOk9O_cPzSUIK8Jz1XoAMf4CVpqnkPMgjxdeGaIlghlxJBM9M9S_QsuPw1YI7YGFAAmeZciFYn2_27dmCylMD6fTD7GUl7opac
Protocol: H2
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sun, 13 Feb 2022 14:52:32 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEJErl9uy28Kl6skugQmqI0g&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 318F 23 B
172 B 279ms
57ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6njwIQ8cnEggIY2dqVwAEwAQ&v=APEucNXXxCezx7UQuSJnukulMLV7lqCwTwIlY506CLoSSU5RZDnKOyG0ZrQ7qN12qFeq75jWelXJ2GmjMJ0f4lOk9O_cPzSUIK8Jz1XoAMf4CVpqnkPMgjxdeGaIlghlxJBM9M9S_QsuPw1YI7YGFAAmeZciFYn2_27dmCylMD6fTD7GUl7opac
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sun, 13 Feb 2022 14:52:32 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame FED0 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 06:02:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31775
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 06:02:56 GMT

GET
H3 200 logo_left.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/ Frame FED0 8 KB
8 KB 8ms
7ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/logo_left.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4d55998ccab91a3ed4dfab41874036cccdc8463e44e5817ff0021d3f9bba272

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 252439
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8235
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 13:24:27 GMT
server: sffe
date: Thu, 10 Feb 2022 16:45:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 16:45:12 GMT

GET
H3 200 layer.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/ Frame FED0 6 KB
6 KB 13ms
12ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/layer.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7719cb7bebb42425a9f17e277409d0c316e112c8eb03323bf5b0b008eb80c7e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 252439
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6553
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 13:24:27 GMT
server: sffe
date: Thu, 10 Feb 2022 16:45:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 16:45:12 GMT

GET
H3 200 background.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/ Frame FED0 47 KB
47 KB 8ms
7ms Image
image/jpeg 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/15682089182182342286/background.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6566bb564279988e52c6cc7518c0d714ed6a47f83109b725f92961488eabb1a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 252439
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48522
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 13:24:27 GMT
server: sffe
date: Thu, 10 Feb 2022 16:45:12 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 10 Feb 2023 16:45:12 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 207A 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53555
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Feb 2023 23:59:56 GMT

GET
DATA 200
OK truncated
/ Frame 207A 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 581569d2581f41051eb7624760e5255675c0b9d3d92ac8a287427f304e5ec3a4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2806 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 48975
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/901669/60420920/ Frame 0874 231 KB
70 KB 76ms
57ms Script
application/javascript 34.250.149.102
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/901669/60420920/skeleton.js?ias_dspID=3&ias_campId=15932658&ias_pubId=pub-2261953515587717&ias_chanId=1&ias_placementId=42708743&bidurl=https://yifysub.net/&ias_dealId=
Requested by: Host: yifysub.net
URL: https://yifysub.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.149.102 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-149-102.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 4ba07246de2ea201c81d346472fefd019206fc468d6223b4ee5ac40fe4ed6f27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 0874 106 KB
37 KB 21ms
7ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53556
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 23:59:55 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame 0874 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DMjQQuK1C4xwYzURdFRLSBK-WSs1mMqm4cZoCxsloKttekUpc0eC7-Qr_kEzlXXv-5kEpHwX4iBvQT4WlMLOPZVLUWDjGtFcvrCxvKJKQPxdRNCwPPHSNTNomMJeM2bMyAvorQXTzQIzseJ1I6WkKXokZLDQ&dbm_d=AKAmf-AaBMGdJhZjLot6i_8FvuSTQjzS8tdgfIkphdk3-Xgc9ShjwVGjFAgyy8wT46GSPohsAZCVRBsL81UpcdZ54QSx-qngUtSay8n96IxfJNKChLwtfEyq_cAvKq8Ty4DfwK3a9i4PFkkBTnVJkigFAxC3PkXFUhlDOgk418PxGGQlB4bcyKYq_Tdi_OwrD1kuJxoU3qbOnVY0QRPLL79nSOgXW8hkODd321sJ9ojNDN9DyIKbJTjR1fzJFopaiOz_pgiw8_4S9kTPcNPu3aYHjagXta6YiyOA4vN0iBM_QadtcLhqu__xP_UmD0jMxyEwb9Xa1Gr55Q7C1JfpqRSMUUbsl-vitXiAuuxvTwYBYBDkbV9aoXXPlKlNPCm0XEVWtr3GJDe9WXMn2T7-LJwcDHWCSz4LXEIUx7p-pVsv-aXMZMjRselKlskUrhoRia0ejzbPIMh3XOR69VGmZgMcj8a3h15zHuPYUEXHkIhRCgVF57GrNHhDftVeNEh2uQPpawGzWpxuEJE8whLsqXB0jLNxjCsCeS1HX4bu7zYg1cf2U6it277sHPO0FgzqpWi_mYDIIXcmG7SqHn7VjaACkWXQljntvX6hVbQEsKUB1fXkrE3oNKQunSm0fCyumhVB3DEE3CWTIEHANxnsX2bzcAA3h5Npw6EkUuJbuZSyh-LLUNqqQ3TwQjnsKoEf0SAOztbFeqCj7HOaSwN4s9xDETZ-ehn8CEvtpkOAJ58zkPUW6lu1cSM00JGPgxSZT0mSsyFW5iJDxnNo2d_1_O4YMJ9IXKoDypsrHrs9nvwL7EUnp3DzE_JLrfd-rw4V9ZtJcQXW5YiAukKkwpmkcVvvdb5ypgpnTtYBUcI50EbJON0Ej785uEjOXc0ZLnmXiZLa9mLAno0NWfzcFuvsRVgxjzQ3q5kIyPA3mM62eIdhSwofPZYfFxqymiz7N8ghTZ0Jg8o1zm75J1v7aSzEX2to0CWsd9RdkQm9YWnxAIO_uaxCvBbOWr6y15Nx1GNXhQ9JlcIZyk10fy5OveNOFSy_0ApxkXa9Z2kTMAHkuLAtzpcS-FPgDRQHK0pfCTMLvFpBO36A5yshfmBZMSPTP0KRyxeS-3-ByXe1CKrDQvM6oa9cGp7SR0PNI4rFAvFyzP86AQtfaMK1D80ZdqDrBR8nm8TPalbFwTwolc9wXLO8s1yrtynltC5LU46yKpW22Heg5XJ7bxNMzJCVccYLWbiOPEAuNOrF6xBbNVv0w_AW0UkgYZemyyHxrxmlp4fYl4tYgD5J3xCISRqVxIkFfu6XhiUAOt4zcldHKalrlvIZVWkwCyYmdIycrhaaPVK9Ar5Ns-Tzk4pOl-O1fVnD4ma4i-o45Ywes84XcR6SPGQQaZi1kqvJvKa9JlSSQ0AeAb7xpi-1CoYmjJK873tJ0WOccMSMTXzqwY1F6icyHUINLdAx6MKpUv9C4k9LaiptC_k5mAgEJCkjek6anVTKBsQuoee1XUtldllxfP2WAUHRWGYK9myX9D68yfJP6jlRHCgPzNnbfcAW1zNbzeImR7M_mGMbQ4AgCPQpaaQlGSL2CYTENYF8Ak9R8U2MyU5NoWkntadykBapZee4_FYnxij41QkYh3-luh_tcFnZaX3-G2jXLEstDJTBJinyIhdrkgVETFLw3HiKFbYY4bRamv2lp29SfienbPcXPIpsk6s7NaOmT3jO4NdALkC5zGq6A7ShstvSVNw60noB9KaMOjGLwwNIRh3M7txHElT2jh5-eqBGMj31kjXi_USwiF3PbOxSDGEJ2JRn2ALDq7YDiPGC8xpSeKfFXtS9tvkuISC4J4usKAKLhOwezsrBr8b0hQs-EqBEoOlqeU-nkZzYpyGGcUtyL_IZoRGw7H6mYrXVu0x2BR8uoEkEimK7Kj7feFVU8tEKZB1bL5my4GjWa1s3j-1PbCuBtvvdQ9aTSMlG_NwLuldncngTSnhXVLQJboRVID8btU9jdKWZRTIq3oC5Enf-aWhXnQOe58x9HKs-N95_dxA8MjkWl3HMVBd59OFsJH7cK9qxxZNUDrHU3mpb26-4vM4TcpZZapsx5W7ZQA-9A2NUOjZuDXGkVY6qUMYo4LfaBswD3t8YylSjjcWllMVvmgRYosH-Xre7VkzwSLuypzsTDliWVXXeHidPYdXqxdpKXlJRhR8qXdRGnORArbYQh_skHBzWeNHw_F0vLQ2Uvw-4yYysaZV6sgOj6UHg1UuNEiRh62gG-pXTMU7Y0Fj8baJYggN1Mh7Z8Y3OinSV-kv-H-EMBV1F5Yt1jiCgQ7wuUF3ifFIrvjneNvwVdi7AI6nBEZt84xHH8J0MUWkKvPLQneEd349sdC9c9Zl1JSymBWqtbObiyVdTI4VmBY0Rws5YVrXxajSXflw7Q3FD7BvDVkwaO8uXRwXHTnb7zfFVFD5yQN2GcOxQVddaJ7F_NrAedTl6BY2doWU3wCP3s9vkQQitYe0YNmx7Vc4ZVClsRSW1Iwr9G1pmDBVwpvVC2cTn-T4E1wW2mJ6teBRR1-FAx4OHc92_tEB5NMlFo_8PSnygLdnXyEX1q7E2XUWczHF6bHye0JftxUfY704P8T6Fy0bpsmWbvJ6EkC-G1lVzPt1usFwJyYbz35Hl98cRKXPn0eHAB9-cJn_84cz42sFPk2kNIPaSHhiUQr9nX4jHgxwT0AmiSj2VWBeVnqDneXzGUqZUxRFmJrQQPVfQIKZ1rxGprn6lpr1NXfF27kNK7v0sP7hcL_o-PSpqddYJISjO8ubZG7Yjh1nc4eCwHx_JJ6NF6ItllzKiLpV6Zf-zqGROs5Ur9Ov1zNNRBGjxl1gzOe9mjob4MjS7V6GnRotDJzlb9gLd2AbvfssaOb0Uk34-WyAWsRSOgFolu4b_53q7YQ&cid=CAASBORo6nA&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame 0874 24 KB
9 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:22 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 15 KB
4 KB 23ms
8ms Document
text/html 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1c45878261567315cd3d512a3ef8c170c0d03b3e8fd1467445e79af4091b60a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 4480
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Wed, 09 Feb 2022 17:45:23 GMT
expires: Thu, 09 Feb 2023 17:45:23 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
content-type: text/html
age: 335228
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 207A 0
571 B 78ms
48ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZWaBFQAVVqwoM6h7_21z5UW_pBdRepM4jgiTkoqypNlANIRKKipqShtLRVJOOMxyhHSL4ccwCkVEzXg2k442RH7Y6WNhTJwNpljdP7QRyfqyAxYtpTs3WU6dXXC6ZqRkeMYC-_C5iVM-OLBFRXCDIYjTSVMjxbdLCo3P624DmQFOrrggbBrsReif3tdBZEpkwH8NbRrliKNzmPzxa18_GcR_Rvf3XQIFR21eMk_Wl17vMjAc4nM9vdNzOpfrB-Eb_TXf-VTEdX-zORc3Ikj9oOf1sPmvUIQRIdJ7IsL5HqlXl7mve-xplA4etjsBjWZhbvit3LM3RzFbwWiRN4hrAWkEiOvQans-sMqbqNyiP7duzS2yR1W4vPbmcKzoh3e_kEtqVgkXyxj3Q7epIimdZ0UemgAEVPypBWPo3bba1bzJZ1fSpv-UCyEsAmWa1wOeZuO3JQnefB0KYHPn2PWdchXf698F_AgrizIUF74K7qMB8ewPTnrluaUM4grjrTLtGiYQabqyHrHPNkNVMjcWabwcfKUnTXreyJPqiDhymMFHiSbxteKUHIT70Mgq72w4f-o9J5Zt7Fqkr8DMyJBUn7Jhf7H8D-pSdOmqJxrvWi4z_h4nGLFJuzCRVMRjqLkZj2b6r_sbgZDtk0UfT_bkgicMp1RFcT_dr0NQgYQ6KbYH2a3fNWEb0UdEsdCriBZ_Y6hNtrHJKrQRCNQEItp0D3v3C0APyvM_uFJs3rPF-1AYIx5PEdV1GEsvKxHaIHZs88i80_gcHw4n1n-bLVfgN3EH6q_83TjptlGQ8v7isgDzjBR2zpf8h715O5HRxOqs96eIa_K2v2--MuSFMeTvEP2-t1FoV-nfyipHDdkSY1s5DzeUkMJoRHDYK5e4o7MTDoufC3zdOE1JQy2pbDnwPQHRL7A2RkqBdKhggVKpYjXwmJsVpKFxrnG6E9MjDZ0eMy8cFJDbR5EpxnnMNymOrIEe5WiJmFHC_HjoNjzA5GJGQiBy7trvVJnz1qZfWvAqt3wo8spPcnUldaLXODbMEuXtVAecLYQoFvUMngxGwCU5D5Yl0qB3ztII_JcC1wP7tbG0haxFJ4oyTsl30CLodeQVEaZrjdvpwyNiHz7eQmOHBm2B-sdc&sai=AMfl-YRgx5108Vo59dNb-qvC8nzfGjLAFk_LaUTArZlegItbElMe1nzl_Uiiu2Zls4V3Kwwit2baSvLYF1xmbRhGTskJuVnX91pGf3dtsXELYi26-Nr52pxitr0bxZz0hh5D5TlW&sig=Cg0ArKJSzNH2u-iK1sowEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=132&cbvp=1&cstd=130&cisv=r20220209.72987&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 13 Feb 2022 14:52:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 0874 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53555
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Feb 2023 23:59:56 GMT

GET
DATA 200
OK truncated
/ Frame 0874 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dc77052e3bdb8e6a94eafc68e657b0887312417245dd5ae1e10d44ecb91309d0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 fiatpro_728x90_eval_102021.html Show response
s0.2mdn.net/sadbundle/11970038483466294934/ Frame 70FC 6 KB
2 KB 7ms
6ms Document
text/html 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c307135e5c747cb1f9fe99795b141ac66a54a3ddb642d9ca889701b71774a7b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 2367
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Mon, 07 Feb 2022 10:29:12 GMT
expires: Tue, 07 Feb 2023 10:29:12 GMT
cache-control: public, max-age=31536000
age: 534199
last-modified: Tue, 12 Oct 2021 15:26:15 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0874 0
61 B 51ms
50ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuxvdUlkj7aWNGj3juP83ixo9qNOFhehnXbmha5WxrwXYrZ4JOxw2vmaGtn5HejPhbhsmeOTCM-Qx3KkgJ08ElYeoiXSOakaVtU7Z0e4mt9EipeGaGtSdq9IqUPADJpIWp7OlYle4BRwFk8R-vmlHHShTLMWfIBOBrHxWC_S9VHUamiri-ByAd6cG-3_3S054VmojKTnHruVIei_wBL4wCOF614M9UruHTgKRwMlcgdi9RffA3Y_SBA5TxhWcstmpIuigHuMpJfb1XFdyWVinodIxFb4lWPvYgYLa7pBmxdJbcR0OPCrW-C7aA4ogSItEYPBvLN8K_UkYCLpGwsBrKCoj1jsbB7zzrWp-jilkwFspsjMWeGfY8vpo_2ERPPsS0XPzFmBJHXZ7ltYn9IZucYS0VKha_mjBFSquBW4pL-uYl6kfQeBzkbP9WnIMQRlB9KK0vrIfpAHhCShtGRECMY6f2WvJukH3fC3RZKqnq2cE31CGfrwYtHUQqnpVLyCrgIP68t31S2e0UZzUCpj4Z966a7bUJ862fa_yfS2lV9FJUgF_PlqI6_Gwiu8VkrBIdZpVDnAZCw2gQ-n-Uluuk7wBROO3A_A3ZF27se90J--yDasybCjm2hCMc8vWz-LIrhbUeVVFyB6UEsBqLCqAZcWqY3zMg8r5c31xiRvPePf44XJvpMplTJyS_QbJKPQkT1sBt5DTNuepYyLM9TFpFPcBMYuamRrnfq8G6bLUvTuPjc9Pj-iknqS8AgNmH7YqliGHog-NCgyNaOnjOv24yCEakFxK1LPRf7sv7nw6QkJeDDJ_6j64TxX1tQ5bSw4i-r3erhTj7oVvz7xKwJwru4l_0PFNhYTof23AAu9UVzuHs9L_nX0baVWzLkqyZPkWMMupE5oanvBqtwqyD_pE2eEgOqKBzAoqjq7IZz0PeqdlQpT-s9e8XK_XnKz9XZwsd4m3bIE5zH2eyNE95DEVayv7_lPhbLms_ara8-qzwV1dwAE2UzFSdQl3DrRYi4Ieigo7INHYIAfBlbE0bKVI6CHQxELQNGWzPQYWWdfc6AiiZhdvvvCvb4p44695pQepNUhSPC4R_n8UCQAOTv5zM3YtNmteNY2Ph2bZ9gxFSJ&sai=AMfl-YQMcY3ZPhGwceLm6Ah5lIPFg-4Ty_X-erQv3CMa5QQVm2WkqQR6-Pzq_irWYg0Lw4lN8LDhbt1INvl6Nq5oZQRXQWvEWPiKwJFz9tEfQLm1gfqEfNw2ieLK1_7NN5NT89Df&sig=Cg0ArKJSzA4u8yxJ0sNUEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=58&cbvp=1&cstd=57&cisv=r20220209.74209&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 13 Feb 2022 14:52:31 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame 2806 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 06:02:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31775
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 06:02:56 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8A19 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 48975
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 anim.min.js Show response
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 8 KB
3 KB 6ms
6ms Script
application/x-javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/anim.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77e773643d244128c52ab5535c162c467b2378bef47a784567d2de56fdd4a9e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 13:05:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265646
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3367
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 10 Feb 2023 13:05:05 GMT

GET
H3 200 polyfill.js Show response
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 6 KB
2 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/polyfill.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59634d2853fa1300f9d99b9d1550fcfd09366ba7ae58776b291af9e67dedaa7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:59:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 417160
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1955
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 18:59:51 GMT

GET
H3 200 img1.jpg
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 55 KB
55 KB 10ms
9ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/img1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e55626e83c9e4a1c1ae18a66b157faa49f73f24b96f609e0d473eb896c8c51b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:59:51 GMT
x-content-type-options: nosniff
age: 417160
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56233
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 18:59:51 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 70FC 236 KB
63 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 14:52:31 GMT

GET
H3 200 fiatpro_728x90_eval_102021.js Show response
s0.2mdn.net/sadbundle/11970038483466294934/ Frame 70FC 45 KB
9 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55c9d64deb33d2861f3c2e5cc0c2e5035b52fcb9e5ffcf83a9ed28bc69f73cbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 10:29:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 534193
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8784
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 15:26:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 10:29:18 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 877 B
904 B 8ms
8ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41a19d96fde3b62300f9f41f049f8881fcb4180a422f06f1ef6eeeb615995eff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 10:01:27 GMT
x-content-type-options: nosniff
age: 535864
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 10:01:27 GMT

GET
H3 200 titillium-web-v10-latin-700.woff
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 15 KB
15 KB 7ms
7ms Font
font/woff 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/titillium-web-v10-latin-700.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae32776aae5fbba5f5e09afbc3f01e948cb97a1434924ebfbf25e8f2661d1625

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 10:01:27 GMT
x-content-type-options: nosniff
age: 535864
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 10:01:27 GMT

GET
H3 200 titillium-web-v10-latin-regular.woff
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 16 KB
16 KB 8ms
8ms Font
font/woff 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/titillium-web-v10-latin-regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11c54a8e83547d7ec3af9960ab4c4b50af1ea2f4bab7f356a6a9a8d3f251c459

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 04:50:38 GMT
x-content-type-options: nosniff
age: 295313
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16572
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 10 Feb 2023 04:50:38 GMT

GET
H3 200 img2.jpg
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 47 KB
47 KB 21ms
20ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/img2.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9bb5e284fd6417375aacbcce95a78e7c9ed33fb2c5e706686d008e024f00b11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 10:01:30 GMT
x-content-type-options: nosniff
age: 535862
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47913
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 10:01:30 GMT

GET
H3 200 img3.jpg
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 18 KB
18 KB 25ms
24ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/img3.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4cc4cadccc053d9e8556db7f6726aa703f5434ecd8c677fb6ecf1a8b36c03bfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:59:52 GMT
x-content-type-options: nosniff
age: 417160
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18222
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 18:59:52 GMT

GET
H3 200 cta-fx.png
s0.2mdn.net/sadbundle/2685531215385082003/300x250/ Frame CD6E 1 KB
1 KB 25ms
24ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/cta-fx.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d91d6727627a6b0c5540c941852e963f30c79ffd9f6779fbb3456036679e152

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2685531215385082003/300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 10:01:32 GMT
x-content-type-options: nosniff
age: 535860
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1073
x-xss-protection: 0
last-modified: Thu, 02 Dec 2021 21:16:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 10:01:32 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 207A 0
23 B 71ms
44ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstZWaBFQAVVqwoM6h7_21z5UW_pBdRepM4jgiTkoqypNlANIRKKipqShtLRVJOOMxyhHSL4ccwCkVEzXg2k442RH7Y6WNhTJwNpljdP7QRyfqyAxYtpTs3WU6dXXC6ZqRkeMYC-_C5iVM-OLBFRXCDIYjTSVMjxbdLCo3P624DmQFOrrggbBrsReif3tdBZEpkwH8NbRrliKNzmPzxa18_GcR_Rvf3XQIFR21eMk_Wl17vMjAc4nM9vdNzOpfrB-Eb_TXf-VTEdX-zORc3Ikj9oOf1sPmvUIQRIdJ7IsL5HqlXl7mve-xplA4etjsBjWZhbvit3LM3RzFbwWiRN4hrAWkEiOvQans-sMqbqNyiP7duzS2yR1W4vPbmcKzoh3e_kEtqVgkXyxj3Q7epIimdZ0UemgAEVPypBWPo3bba1bzJZ1fSpv-UCyEsAmWa1wOeZuO3JQnefB0KYHPn2PWdchXf698F_AgrizIUF74K7qMB8ewPTnrluaUM4grjrTLtGiYQabqyHrHPNkNVMjcWabwcfKUnTXreyJPqiDhymMFHiSbxteKUHIT70Mgq72w4f-o9J5Zt7Fqkr8DMyJBUn7Jhf7H8D-pSdOmqJxrvWi4z_h4nGLFJuzCRVMRjqLkZj2b6r_sbgZDtk0UfT_bkgicMp1RFcT_dr0NQgYQ6KbYH2a3fNWEb0UdEsdCriBZ_Y6hNtrHJKrQRCNQEItp0D3v3C0APyvM_uFJs3rPF-1AYIx5PEdV1GEsvKxHaIHZs88i80_gcHw4n1n-bLVfgN3EH6q_83TjptlGQ8v7isgDzjBR2zpf8h715O5HRxOqs96eIa_K2v2--MuSFMeTvEP2-t1FoV-nfyipHDdkSY1s5DzeUkMJoRHDYK5e4o7MTDoufC3zdOE1JQy2pbDnwPQHRL7A2RkqBdKhggVKpYjXwmJsVpKFxrnG6E9MjDZ0eMy8cFJDbR5EpxnnMNymOrIEe5WiJmFHC_HjoNjzA5GJGQiBy7trvVJnz1qZfWvAqt3wo8spPcnUldaLXODbMEuXtVAecLYQoFvUMngxGwCU5D5Yl0qB3ztII_JcC1wP7tbG0haxFJ4oyTsl30CLodeQVEaZrjdvpwyNiHz7eQmOHBm2B-sdc&sai=AMfl-YRgx5108Vo59dNb-qvC8nzfGjLAFk_LaUTArZlegItbElMe1nzl_Uiiu2Zls4V3Kwwit2baSvLYF1xmbRhGTskJuVnX91pGf3dtsXELYi26-Nr52pxitr0bxZz0hh5D5TlW&sig=Cg0ArKJSzNH2u-iK1sowEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=275&vt=11&dtpt=143&dett=3&cstd=130&cisv=r20220209.72987&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 207A
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/895631/58886992/4.js?ias_dspID=3&ias_campId=25570486&ias_pubId=pub-2261953515587717&ias_chanId=1&ias_placementId=15519062596&bidurl=https://yifysub.net/&ias_de...
https://static.adsafeprotected.com/4.js

1 KB
1 KB

23ms
23ms

Script
application/javascript

2600:9000:2190:e400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159
Protocol: H2
Server: 2600:9000:2190:e400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 460ff0b1da5bacd95df6905ad1c8df05bdda30aa4189e2fef38b53b6318e42ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 21:45:01 GMT
content-encoding: gzip
age: 234451
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 10 Feb 2022 21:44:59 GMT
server: AmazonS3
etag: W/"96e16e7453ae2e6952bc6d2a20ea29f7"
vary: Accept-Encoding
x-amz-version-id: WQohwvyxqSXtLQ0CYtip6YPzB4rvFs6y
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript
x-amz-cf-id: RHiiIs1HZjpvkyKkfOBBwTcjhGnLi9pBJRAW1aa2EskVKt0gWSLAoQ==

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: app20.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 1D34 80 KB
21 KB 85ms
23ms Script
application/javascript 2600:9000:2190:e400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:e400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 10:01:19 GMT
content-encoding: gzip
age: 7015874
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript
x-amz-cf-id: EtZwVUMvH4nDFjwDWzje-8st2_be3j7hg2EZe43QvEk5ST6TnpHjVA==

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 0874
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/901669/60420920/4.js?ias_dspID=3&ias_campId=15932658&ias_pubId=pub-2261953515587717&ias_chanId=1&ias_placementId=42708743&bidurl=https://yifysub.net/&ias_dealI...
https://static.adsafeprotected.com/4.js

1 KB
1 KB

13ms
13ms

Script
application/javascript

2600:9000:2190:e400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Server: 2600:9000:2190:e400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 460ff0b1da5bacd95df6905ad1c8df05bdda30aa4189e2fef38b53b6318e42ff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 21:45:01 GMT
content-encoding: gzip
age: 234451
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Thu, 10 Feb 2022 21:44:59 GMT
server: AmazonS3
etag: W/"96e16e7453ae2e6952bc6d2a20ea29f7"
vary: Accept-Encoding
x-amz-version-id: WQohwvyxqSXtLQ0CYtip6YPzB4rvFs6y
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
cache-control: max-age=604800
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript
x-amz-cf-id: ewNhEhN3Uot1eNKDIa1jQgOIFg6TLEZ8X0yLMBQLVKjqhJ2nC4UC_A==

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: app09.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 3475 80 KB
21 KB 56ms
34ms Script
application/javascript 2600:9000:2190:e400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2190:e400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 10:01:19 GMT
content-encoding: gzip
age: 7015874
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: ZRH50-C1
content-type: application/javascript
x-amz-cf-id: iycEO7V4CHDNzjQH7VhVa6-ViMXYXqLp0k7Pi3tjRt9mlv4H0rei_g==

GET
H3 200 16331695687955026148
tpc.googlesyndication.com/simgad/ Frame A05E 14 KB
14 KB 17ms
17ms Image
image/png 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/16331695687955026148?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmSvvhvdpLLOxkzU0us3ZfRTd2gIA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=317821684&pi=t.aa~a.3087911199~rp.4&w=883&lmt=1644763951&nsk=a53385ba&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=631&idt=-M&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280&nras=2&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1241&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=mugYgwaWgs&p=https%3A//yifysub.net&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bdc754369827d67e140b7fea139400f7212bec22c8382b92701d4212e011739

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 23:10:32 GMT
x-content-type-options: nosniff
age: 402120
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14594
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 14:15:25 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 08 Feb 2023 23:10:32 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame A05E 19 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:24 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 207A 43 B
216 B 532ms
156ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=895631&asId=9c8d00c5-f989-d5d4-4ef4-31ff7dae9bb2&tv=%7Bc:473iB5,pingTime:-3,time:124,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:21%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:125,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B118~0%5D,as:%5B118~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141*.895631-58886992%7C1411%7C14121%7C1413%7C15%7C16%7C1711%7C1712%7C1713,idMap:141*,rmeas:1,rend:0,renddet:na%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt14.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 207A 43 B
215 B 530ms
157ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=895631&asId=9c8d00c5-f989-d5d4-4ef4-31ff7dae9bb2&tv=%7Bc:473iB7,pingTime:-6,time:126,type:i,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:126,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B119~0%5D,as:%5B119~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141*.895631-58886992%7C1411%7C14121%7C1413%7C15%7C16%7C1711%7C1712%7C1713,idMap:141*,rmeas:1,rend:0,renddet:na%7D&tpiLookup=ao:yifysub.net*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt15.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0874 43 B
215 B 521ms
157ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=901669&asId=3e6ee2e5-14ba-b4c5-6b10-be68465076da&tv=%7Bc:473iBi,pingTime:-3,time:86,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:17%7D%5D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:86,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B80~0%5D,as:%5B80~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141.895631-58886992%7C1411%7C14121%7C1413%7C1414%7C15%7C16%7C171*.901669-60420920%7C1711%7C1712%7C1713,idMap:171*,rmeas:1,rend:0,renddet:na%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0874 43 B
215 B 671ms
309ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=901669&asId=3e6ee2e5-14ba-b4c5-6b10-be68465076da&tv=%7Bc:473iBj,pingTime:-6,time:87,type:i,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:87,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B81~0%5D,as:%5B81~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141.895631-58886992%7C1411%7C14121%7C1413%7C1414%7C15%7C16%7C171*.901669-60420920%7C1711%7C1712%7C1713,idMap:171*,rmeas:1,rend:0,renddet:na%7D&tpiLookup=ao:yifysub.net*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt04.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 fiatpro_728x90_eval_102021_atlas_P_1.png
s0.2mdn.net/sadbundle/11970038483466294934/images/ Frame 70FC 453 KB
453 KB 9ms
9ms Image
image/png 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11970038483466294934/images/fiatpro_728x90_eval_102021_atlas_P_1.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a18aebfb22e1f1fa300b5094295fc551e8fc22c41e5171b6ae788eacedd9e62d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 10:29:12 GMT
x-content-type-options: nosniff
age: 534200
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 463740
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 15:26:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 10:29:12 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0874 0
23 B 46ms
46ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuxvdUlkj7aWNGj3juP83ixo9qNOFhehnXbmha5WxrwXYrZ4JOxw2vmaGtn5HejPhbhsmeOTCM-Qx3KkgJ08ElYeoiXSOakaVtU7Z0e4mt9EipeGaGtSdq9IqUPADJpIWp7OlYle4BRwFk8R-vmlHHShTLMWfIBOBrHxWC_S9VHUamiri-ByAd6cG-3_3S054VmojKTnHruVIei_wBL4wCOF614M9UruHTgKRwMlcgdi9RffA3Y_SBA5TxhWcstmpIuigHuMpJfb1XFdyWVinodIxFb4lWPvYgYLa7pBmxdJbcR0OPCrW-C7aA4ogSItEYPBvLN8K_UkYCLpGwsBrKCoj1jsbB7zzrWp-jilkwFspsjMWeGfY8vpo_2ERPPsS0XPzFmBJHXZ7ltYn9IZucYS0VKha_mjBFSquBW4pL-uYl6kfQeBzkbP9WnIMQRlB9KK0vrIfpAHhCShtGRECMY6f2WvJukH3fC3RZKqnq2cE31CGfrwYtHUQqnpVLyCrgIP68t31S2e0UZzUCpj4Z966a7bUJ862fa_yfS2lV9FJUgF_PlqI6_Gwiu8VkrBIdZpVDnAZCw2gQ-n-Uluuk7wBROO3A_A3ZF27se90J--yDasybCjm2hCMc8vWz-LIrhbUeVVFyB6UEsBqLCqAZcWqY3zMg8r5c31xiRvPePf44XJvpMplTJyS_QbJKPQkT1sBt5DTNuepYyLM9TFpFPcBMYuamRrnfq8G6bLUvTuPjc9Pj-iknqS8AgNmH7YqliGHog-NCgyNaOnjOv24yCEakFxK1LPRf7sv7nw6QkJeDDJ_6j64TxX1tQ5bSw4i-r3erhTj7oVvz7xKwJwru4l_0PFNhYTof23AAu9UVzuHs9L_nX0baVWzLkqyZPkWMMupE5oanvBqtwqyD_pE2eEgOqKBzAoqjq7IZz0PeqdlQpT-s9e8XK_XnKz9XZwsd4m3bIE5zH2eyNE95DEVayv7_lPhbLms_ara8-qzwV1dwAE2UzFSdQl3DrRYi4Ieigo7INHYIAfBlbE0bKVI6CHQxELQNGWzPQYWWdfc6AiiZhdvvvCvb4p44695pQepNUhSPC4R_n8UCQAOTv5zM3YtNmteNY2Ph2bZ9gxFSJ&sai=AMfl-YQMcY3ZPhGwceLm6Ah5lIPFg-4Ty_X-erQv3CMa5QQVm2WkqQR6-Pzq_irWYg0Lw4lN8LDhbt1INvl6Nq5oZQRXQWvEWPiKwJFz9tEfQLm1gfqEfNw2ieLK1_7NN5NT89Df&sig=Cg0ArKJSzA4u8yxJ0sNUEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=317&vt=11&dtpt=259&dett=3&cstd=57&cisv=r20220209.74209&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A05E 0
0 82ms
82ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C4rPNLxsJYuXxJtfUYJelm7AE-OKkk2juudTCmg_bveX6xyUQASDL15ZQYJXikIKgB6ABmKqOtQHIAQKpAsAI0yyNCrM-qAMByAPJBKoEyQFP0P8KBHwG19pFFvE6QwBT5bBPpwiS-cd315i9yt6Y1XAUnR5AyTLbU9z1uG_jQVrChUtzTMKVO1qCD9OvNd8i3P8WaDDY85k5MVHg_E31NshpGU8O4mUnTYZiV12dvucEY_aSfl4GvaQHQ-uhVDIVLLjDElc55Q9IE-iIpyt_YOoZBEn5l-10sYQE9gQBghBgVo2XpRd3Wkc2-3QABlu1-ecvpCU2YVDZa3hXKX7b5LRQUXkKksfqqukihU3fuWeKBSp-BAeF8GrABLfJnt7EA5IFBAgEGAGSBQQIBRgEoAYCgAer5PHKAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcDEI5M0ggJCIDhgBAQARgfgAoByAsB2BMC0BUBgBcBshccChoIABIUcHViLTIyNjE5NTM1MTU1ODc3MTcYAA&sigh=5t-jYqXcBoI&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=317821684&pi=t.aa~a.3087911199~rp.4&w=883&lmt=1644763951&nsk=a53385ba&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=631&idt=-M&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280&nras=2&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1241&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=mugYgwaWgs&p=https%3A//yifysub.net&dtd=10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sun, 13 Feb 2022 14:52:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame A05E 2 KB
1 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:50:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:50:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A05E 124 KB
38 KB 34ms
34ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:32 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame A05E 15 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:46:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:46:05 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame A05E 28 KB
11 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3b84e5e485619983c2f805dac6f3fde572d0c825c672d1a02f48af0149eea93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 13:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3836
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11662
x-xss-protection: 0
server: cafe
etag: 6226773659199191033
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 13:48:36 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 207A 43 B
215 B 653ms
310ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=895631&asId=9c8d00c5-f989-d5d4-4ef4-31ff7dae9bb2&tv=%7Bc:473iBB,pingTime:-2,time:156,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:384,beZ:385,mfA:387,cmA:389,inA:389,inZ:393,prA:393,prZ:399,si:406,poA:407,poZ:433,cmZ:433,mfZ:433,loA:509,loZ:511,ltA:540,ltZ:540%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:21%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:156,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B150~0%5D,as:%5B150~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141*.895631-58886992%7C1411%7C14121%7C1413%7C15%7C16%7C171.901669-60420920%7C1711%7C1712%7C1713,idMap:141*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,sinceFw:133,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt02.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0874 43 B
215 B 490ms
158ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=901669&asId=3e6ee2e5-14ba-b4c5-6b10-be68465076da&tv=%7Bc:473iBN,pingTime:-2,time:117,type:a,im:%7Bsf:0,pci:%7Btdr:79%7D,pom:1,prf:%7BbeA:371,beZ:372,mfA:374,cmA:375,inA:376,inZ:379,prA:379,prZ:384,si:390,poA:391,poZ:410,cmZ:410,mfZ:410,loA:458,loZ:460,ltA:489,ltZ:489%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:17%7D%5D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:117,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B112~0%5D,as:%5B112~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141.895631-58886992%7C1411%7C14121%7C1413%7C1414%7C15%7C16%7C171*.901669-60420920%7C1711%7C1712%7C1713,idMap:171*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,sinceFw:98,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt03.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3B9B 143 B
163 B 10ms
9ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=317821684&pi=t.aa~a.3087911199~rp.4&w=883&lmt=1644763951&nsk=a53385ba&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=631&idt=-M&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280&nras=2&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1241&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=mugYgwaWgs&p=https%3A//yifysub.net&dtd=10

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Sun, 13 Feb 2022 14:03:09 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 2963
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 771C 1 KB
749 B 9ms
8ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Sun, 13 Feb 2022 05:53:44 GMT
expires: Mon, 14 Feb 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 32328
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame 8A19 35 KB
13 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 06:02:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 06:02:56 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 207A 0
20 B 40ms
39ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=pvtw&eid=LxsJYuOYKtyw3gOatayIAQ&p=ias&bl=0&twt=507&st=333

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3B1E 624 B
297 B 20ms
19ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAl6p5MAE&v=APEucNUqaQIMnniJvWzhQCxNI3FZuFUaJWpZPxedTgYEQxWOPbG4t6iOsE16TMBZ_9fSBmgNXdiTeYIejQqOWmKe5p9u3MuQdJLYxWcCX0gpYij_GfqnUbwtkU3_MrddSHT_AYxk1W1tshc001OXmZaykdAzXvkjYDW5qqlHGOqbvYROTp793qA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 13 Feb 2022 14:52:32 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3598 75 KB
31 KB 76ms
75ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DqTW-Z0qCp0HyeyGrRvNuiPOjnUjAZKUuo6Qd-IspazYaJN5IWKE09awV16nI0G5jSTUEVI8NwJg8B-9ZgpvJjXEqvVg_UEOkMIDApKKHabWmg-34xwxamgYokc4GfZbinS40HGgM8H5ANJqFPAYT2QG63mA&dbm_d=AKAmf-Dnz9k6Lqdi8QWpjAJ_CcVnakzaLg9K2VlXHPZShV8EqrCa0KhSp-TaDhZAiWgAvjQVJ54Gl-nyQDF-hlHDA9W7XGHQd4q4ANMBo_XEYQ24PqqDK6eVFQju2riBdf-PViXwoKTy7EFSjc5NkeppOmUKyu1xYi0Rz0AtmynkieToXN5__AwWoEKjZdOkMnh8jF4HqWRyR-2pr15mTijCzhx0Vf4p6jjtUbNCz22AStp8RLVozAyn7Q-Eyw5uRkGn51MsBmCOvqUPl_dd6Pl48ewUNaUlNp7fgmfuWwdhVtrA3DMtjZM-9XaQ5bIecXkCHLkoVgk6H877iiPoOzwq4xEX8z27EQaxhb7cYmuLlUG8XI117pA3-r1xtz3X2A3bLnarZZsa7Fn5tN2B3fNkiPrppq7EtYnbvjtTVQ3skNhPtCLK9bzA9stJUBm6WVS5z14i2N80EPIIC-npCqUu8a3uR_n7gSiqGyScQ1HV_RdN1qVe8O8Kpajg1DCDYjhY9MWt_PwiFbeRSpH1z1HsGYykzKlZzwgZuyM_5mlHyJsh9l6IWhyIuLVw_BxL0yN399zNBrKYIr3P-FYPHhu1matY4tT8Rao0N6llYrxFK6OiPd2LgClU9H-TOhe9ue3mGPa4msfPgGOA8oKqXxVbVFAlgzYXo9HBbVjVWGFJ_dHGbHYvsmyuhv1vx87ivE7cnj_nU8BI6ygeESfgIfgABDtc1Un-HDPIhVIGg-kIgILqE6HuOGfprH2SgqJmBe_srK_AJuM4oSZS8b1a9StRja1olNhw91xX4ZlfrRGorN54MkfeIb0EDPl7lRlQEyFz6MiKvz_hFl79fGKcjPR0iAHFagCK0oBwfY_TY1T-Tp6nYwX11DiwNwjmsbUKMGVQXmXCpWa1ElQGPJRinwmkaPTDSGMWz1keVOG48_I_vwEqAwrRQS8Y-G2wO55Fg_ywYQNjyhsqvaHARMhrNKRrmqNRJbEhR3DIin2kbzLkwS34kVt0cMvaPhzD0VQx9p2FP8FPHPdrs0f3XN5tVpJr0Bb0Ka9gAIPXMuDjf9wCQxmL4apRsKK7YkyWX4KK9gZ_tFjDJWJxvpaCbRw9NOoHGwAl3b-KGKvJXpfZ5lIUlR_A1r7N8AMDVmEusHw7qAiWOyDxSueEoDVOnH6RsjYuGGt4MuA-MkY6NbpfUilMI8hEvysyurlzy5tCkb_8-WkDw5f4vwU1PDB6e_EJJHY7OvxXxeu4_1ituIFF62I-6x8vx3I3PrvLtfklC07ODRqOr1ACEkxbz3ouLJfNBgFjOASFUoGXIofnkxomZJbBDRMLfl-5GcgoL0crHTytvol3Grffy_WrxXflX6Fti_Kw9hD44bp7JMYYD1ByfwLqdtlhezoZB83QQYukWIjmU6BXeTFbDgGd1ocRS9LNxDJ0Pmz9Nkm2qR9TLZ2ZP7SnnUS8-7PHLpxY36yKlzhiv7bIxCrN0auaqOX98ms-fmLg6jBbxPiQN6nyiWKWXeWwJP9tK2oSM1WSaZn-dkjM_vCtDGt5kGs8eeSmkWBVK5XiGkR9nnngJtJ88iBEOSgbH7W1XFNoewXO2bD3FJqdEFWifIsKqLq28rtTASU1D8xUhISWHM7pjz1exkPc62s0XuTBpErV9wMiNibRtPvQy9rZKXddDMAYi0hcQmxaWHuykP2ESgVWlKciaWTuGZnwGSwAhFlvaU5V4KiQ-EqT3XCzPZdHTlnXXyA4CDDfrGviPAHscNMPtAQH8g9iNUI812aeBawWDSDD4twM1kT4WTVJ019FnI6FMstrdEHCUvoQVsHvWOw8E1ANpD0UIcogiOcqBr-mKapu11tmS0YuALzhXc4jQRvBghL6QhRZ5SLgxu94CK8GZn7j7b5kIC0Qj8f4xSvukpugqaGByu5DPqxFNC_7ssfv1ATbvJAry-db-FJE_Vzxlfd38_L6Wy-S9eSJfgO66oI3fkeEwgamP2NMo2fjkv0KItqAYmqkfMFfpUU-8biKnMSc71ZasTjTFgG00DWjhujrmp9Zkv-6bkvQnqfZWtC0ZCODejfpStF34h3PjzQYSdzBIKWvEeOO6vPKJ8RHZ2lHt-9n2xxQEo41t-HmSTpK_0eyVZnb5xdH2JJJnuN3ICasp9-4Djd2SII8qRJ4AeD6g1V-Pt6Hgi-l4MGLnZg4pJj91M37_jYD6WrbuTkzbD-qcUFGQQ33CtcTQ8p-sfmxwZnE8L03iHsI95Fll-5kDhZMUk5GY5WpKkh8PoSz_y3RPC0tX5AEYQC5oR0_KinZrTcpxi-Rapglyu5zxNvGOflnG6nveTKHshd0HnkCNvAa3oxcHPMvMBH6nexKaXjLAO4iQyfqywLuLOGDppP6Ar3qQCP6BS-4IHCRFm5ZL_CZD1c5jqyLXzYaQGuqCyoNuR5UsNwvIfhwizgmbbb_j5JWyn6BmZMZik6Drt6HBPXhjNVWGeCdHV5HXpXZTcwkAPJZTw7vxXlbH4keEMQpt7U8dnSPy0_Lz0je9dr0Ic3M8d-lo9ZUeNqEQqeZXq9O5Cuj1H6GkiIigFcVJny6EXAwP-T4w6Jep3bGyKCbOWpe_TIZyWZl7kM6xF7VedIoY1rt8qdVPfYd3CVkH9UxHWHtkjQKOpV3tER0UbZDxqG4IA3MNmIJ7BiBuLEYvs0AXMzS0OB8_0rKjQQwxp3RJfUJ6UqfY6lUk-VOXdK3MLdajzF_KOHNhl24VpKwn9a1CzMs7Pbdu3Ii7qrjuGSXzy88krXjfDl0XIUV-ST3Ye5FWbhpx67MX8PoP6PaNDhldZ7X-GILYUMyJg50b6gh9PuGQSHzncIzXMHNavOP1vBNEg7oIX2w2FW_ont0BQ393eiT_Dzme8J_dgR8yomsi1Gw9dEorzmCbvcqldj6VumfeNsj2MfXTi13OZjEWuxVuURr1IW0fhS4IrMtjOAXMFvl-KKbP0shMMYy3JgvjXJ66zCdVX5Qlc5cI3k2CCQ&cid=CAASEuRoceDhdNu-LXQZmL23hlQy9w&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19cbf8d70f0387e9e6ec589281f49f7e01bf48b98806eebb25fa3646ebf7dc2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31918
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 3598 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:50:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:50:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3598 124 KB
38 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:32 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame 3598 15 KB
6 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:46:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:46:05 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3598 0
0 17ms
16ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSpRuNZqfpI-PdFdzijs9w9-oXOI6nXiCJe34lqR-HHJ5eBsIzK2kNJMdeivr2co2L4R-9ZU9iu78sBuwdz1VCbKYsCkA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3598 42 B
63 B 43ms
41ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BICB7LpeT9rqmhpJ2od2Bw2GfYdRiDQtCOE_-qa850wXBxwOwU_bJJ3r410C1cJZsh6jrwpdVCiZFA6TIXvaYuk1QBiApktM-gsdDmhNrTSPEnM7M

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame A05E 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef8ec8d6dbbe052df2d3ae1a1f8d69a882fbbe2acff13c202f6d1d8fe0bf1e22

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 fiatpro_728x90_eval_102021_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/11970038483466294934/images/ Frame 70FC 17 KB
17 KB 10ms
7ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11970038483466294934/images/fiatpro_728x90_eval_102021_atlas_NP_1.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2eb6b8c3bcd2e94b7aa0434887e9c06f68def607b9144030bf4c0c10ba18f826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11970038483466294934/fiatpro_728x90_eval_102021.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Mon, 07 Feb 2022 10:29:12 GMT
x-content-type-options: nosniff
age: 534200
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17799
x-xss-protection: 0
last-modified: Tue, 12 Oct 2021 15:26:15 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 07 Feb 2023 10:29:12 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 771C 35 B
464 B 42ms
8ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEBPkURV9cPoWWgU-i26qVX0&google_cver=1&google_push=AYg5qPJTOEjisDD8TYOhhCQ3RCrPghkiNZJne7rnQ8NfhJbOzRPrUYpwFM3uR9iUb4fz0-iJAOu2MkpK7Fstszc0z0ihZVmZ-PmhdQ

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 771C
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEEIHmi3HhMsM53Vjx8a_mEw&google_cver=1&google_push=AYg5qPKSc9iN96CfiZfBiiGGDbjJfsa-dFQLybsso-f61KB9xwX6lcxHpNjxVbFf2SY_lEmgbraBR4dvCmAia4FrdKXRJah2qh9ifA
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKSc9iN96CfiZfBiiGGDbjJfsa-dFQLybsso-f61KB9xwX6lcxHpNjxVbFf2SY_lEmgbraBR4dvCmAia4FrdKXRJah2qh9ifA&google_hm=Q0FFU0VFSUhtaTNIaE1...

170 B
188 B

36ms
36ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKSc9iN96CfiZfBiiGGDbjJfsa-dFQLybsso-f61KB9xwX6lcxHpNjxVbFf2SY_lEmgbraBR4dvCmAia4FrdKXRJah2qh9ifA&google_hm=Q0FFU0VFSUhtaTNIaE1zTTUzVmp4OGFfbUV3

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:31 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKSc9iN96CfiZfBiiGGDbjJfsa-dFQLybsso-f61KB9xwX6lcxHpNjxVbFf2SY_lEmgbraBR4dvCmAia4FrdKXRJah2qh9ifA&google_hm=Q0FFU0VFSUhtaTNIaE1zTTUzVmp4OGFfbUV3
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 771C 43 B
351 B 46ms
16ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPCXwglSuZBMSlG95Cta4yI&google_cver=1&google_push=AYg5qPKHLz5eLURWRCC2zg-ByIQokKW3i7HPNc0TgYHzQVpG6hdS2yqxW-zVRm_FqxKc9sskc8G-7x4XPfR02Ad881mo881yA3wS8Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=317821684&pi=t.aa~a.3087911199~rp.4&w=883&lmt=1644763951&nsk=a53385ba&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=631&idt=-M&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280&nras=2&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1241&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=mugYgwaWgs&p=https%3A//yifysub.net&dtd=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: i52d8pgq0d1o04h3383p7dpbq846ha45

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 771C
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lcHf_V9DTVytiDnmYC78WQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

34ms
34ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lcHf_V9DTVytiDnmYC78WQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLwqZAw-Yps_Ef-p4i3ZIvsskA-CkdFdmaXzm5anUl_YTIUvQugTVSd9U7AXG8FMedvzWaM2mvcYMSapE3P-kjANQWe0AReZQ

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=lcHf_V9DTVytiDnmYC78WQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLwqZAw-Yps_Ef-p4i3ZIvsskA-CkdFdmaXzm5anUl_YTIUvQugTVSd9U7AXG8FMedvzWaM2mvcYMSapE3P-kjANQWe0AReZQ
date: Sun, 13 Feb 2022 14:52:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 771C
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHE4eMfctzRWUaQV4JBNApU&google_cver=1&google_push=AYg5qPLFQ4I6P6nHnWAkaGWa0KLbEdz8Gb0nqMbpfgvjV38tjqcOMw8rIyAQXnQMoiEOFq03vJa...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pMRFpOWjgtSS1GME9K&google_push=AYg5qPLFQ4I6P6nHnWAkaGWa0KLbEdz8Gb0nqMbpfgvjV38tjqcOMw8rIyAQXnQMoiEOFq03vJaBH_GVoQ32nneT5zEZUd9hT6J6Rw

170 B
188 B

37ms
36ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pMRFpOWjgtSS1GME9K&google_push=AYg5qPLFQ4I6P6nHnWAkaGWa0KLbEdz8Gb0nqMbpfgvjV38tjqcOMw8rIyAQXnQMoiEOFq03vJaBH_GVoQ32nneT5zEZUd9hT6J6Rw

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pMRFpOWjgtSS1GME9K&google_push=AYg5qPLFQ4I6P6nHnWAkaGWa0KLbEdz8Gb0nqMbpfgvjV38tjqcOMw8rIyAQXnQMoiEOFq03vJaBH_GVoQ32nneT5zEZUd9hT6J6Rw
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 771C
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_gid=CAESEJQhaPr7VMe8I82gTfZhIV4&google_push=AYg5qPKYKzrz0MflxXpDPoMbbyyxLQ-GlE4Ru2prJGwBbly4Gw1...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 771C 43 B
296 B 182ms
20ms Image
image/gif 2a05:d01c:1d8:8102:affb:bb24:d447:85fc
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEL1FV2ovqajHbmpvPJQKrDU&google_cver=1&google_push=AYg5qPJcxMpN81FtcXi5RAvqJWh5GxTNCAtlWVHx2BfPB7g7xCidqtpvjxJdovTXT0JtzE3bZGcjGluTNpT9X83xcoYRDB7p14WC
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=317821684&pi=t.aa~a.3087911199~rp.4&w=883&lmt=1644763951&nsk=a53385ba&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=631&idt=-M&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280&nras=2&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1241&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=mugYgwaWgs&p=https%3A//yifysub.net&dtd=10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:affb:bb24:d447:85fc London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 771C 0
12 B 22ms
20ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KefRgpCMLCWAu0e0i3Vr7WhG-lyXqZXLbh-Idiwx_Qt_y489tsNe4tNhbX0qqMgXaw2UEk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3B1E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECiZAZVwJMG8F6n2Wnu59SA&google_cver=1

43 B
894 B

37ms
37ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECiZAZVwJMG8F6n2Wnu59SA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAl6p5MAE&v=APEucNUqaQIMnniJvWzhQCxNI3FZuFUaJWpZPxedTgYEQxWOPbG4t6iOsE16TMBZ_9fSBmgNXdiTeYIejQqOWmKe5p9u3MuQdJLYxWcCX0gpYij_GfqnUbwtkU3_MrddSHT_AYxk1W1tshc001OXmZaykdAzXvkjYDW5qqlHGOqbvYROTp793qA
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 14:52:32 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECiZAZVwJMG8F6n2Wnu59SA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3B1E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YgkbL0stH6n6.sY06wEZzQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECiZAZVwJMG8F6n2Wnu59SA&google_cver=1&google_hm=2

43 B
894 B

32ms
31ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECiZAZVwJMG8F6n2Wnu59SA&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAl6p5MAE&v=APEucNUqaQIMnniJvWzhQCxNI3FZuFUaJWpZPxedTgYEQxWOPbG4t6iOsE16TMBZ_9fSBmgNXdiTeYIejQqOWmKe5p9u3MuQdJLYxWcCX0gpYij_GfqnUbwtkU3_MrddSHT_AYxk1W1tshc001OXmZaykdAzXvkjYDW5qqlHGOqbvYROTp793qA
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:32 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 13 Feb 2022 14:52:32 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECiZAZVwJMG8F6n2Wnu59SA&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3B1E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEM6w8rpScwjhfQks1y10VwM&google_cver=1

43 B
1004 B

16ms
16ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEM6w8rpScwjhfQks1y10VwM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNHn4wEQ4JWpAhjAl6p5MAE&v=APEucNUqaQIMnniJvWzhQCxNI3FZuFUaJWpZPxedTgYEQxWOPbG4t6iOsE16TMBZ_9fSBmgNXdiTeYIejQqOWmKe5p9u3MuQdJLYxWcCX0gpYij_GfqnUbwtkU3_MrddSHT_AYxk1W1tshc001OXmZaykdAzXvkjYDW5qqlHGOqbvYROTp793qA

Protocol

HTTP/1.1

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:32 GMT
X-Proxy-Origin: 217.64.151.28; 217.64.151.28; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 44500655-9b8a-4ce9-96cb-79b89ef1e7b2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEM6w8rpScwjhfQks1y10VwM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B1E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMjAxMjI2ODA4ODQyNzUzNQ%3D%3D

170 B
188 B

34ms
33ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMjAxMjI2ODA4ODQyNzUzNQ%3D%3D

Requested by

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:32 GMT
X-Proxy-Origin: 217.64.151.28; 217.64.151.28; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f774e639-36ce-4b66-986e-1d9ee96b4ae7
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTIyMjAxMjI2ODA4ODQyNzUzNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 3598 169 KB
59 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 15:15:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85023
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 15:15:29 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame 3598 8 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DqTW-Z0qCp0HyeyGrRvNuiPOjnUjAZKUuo6Qd-IspazYaJN5IWKE09awV16nI0G5jSTUEVI8NwJg8B-9ZgpvJjXEqvVg_UEOkMIDApKKHabWmg-34xwxamgYokc4GfZbinS40HGgM8H5ANJqFPAYT2QG63mA&dbm_d=AKAmf-Dnz9k6Lqdi8QWpjAJ_CcVnakzaLg9K2VlXHPZShV8EqrCa0KhSp-TaDhZAiWgAvjQVJ54Gl-nyQDF-hlHDA9W7XGHQd4q4ANMBo_XEYQ24PqqDK6eVFQju2riBdf-PViXwoKTy7EFSjc5NkeppOmUKyu1xYi0Rz0AtmynkieToXN5__AwWoEKjZdOkMnh8jF4HqWRyR-2pr15mTijCzhx0Vf4p6jjtUbNCz22AStp8RLVozAyn7Q-Eyw5uRkGn51MsBmCOvqUPl_dd6Pl48ewUNaUlNp7fgmfuWwdhVtrA3DMtjZM-9XaQ5bIecXkCHLkoVgk6H877iiPoOzwq4xEX8z27EQaxhb7cYmuLlUG8XI117pA3-r1xtz3X2A3bLnarZZsa7Fn5tN2B3fNkiPrppq7EtYnbvjtTVQ3skNhPtCLK9bzA9stJUBm6WVS5z14i2N80EPIIC-npCqUu8a3uR_n7gSiqGyScQ1HV_RdN1qVe8O8Kpajg1DCDYjhY9MWt_PwiFbeRSpH1z1HsGYykzKlZzwgZuyM_5mlHyJsh9l6IWhyIuLVw_BxL0yN399zNBrKYIr3P-FYPHhu1matY4tT8Rao0N6llYrxFK6OiPd2LgClU9H-TOhe9ue3mGPa4msfPgGOA8oKqXxVbVFAlgzYXo9HBbVjVWGFJ_dHGbHYvsmyuhv1vx87ivE7cnj_nU8BI6ygeESfgIfgABDtc1Un-HDPIhVIGg-kIgILqE6HuOGfprH2SgqJmBe_srK_AJuM4oSZS8b1a9StRja1olNhw91xX4ZlfrRGorN54MkfeIb0EDPl7lRlQEyFz6MiKvz_hFl79fGKcjPR0iAHFagCK0oBwfY_TY1T-Tp6nYwX11DiwNwjmsbUKMGVQXmXCpWa1ElQGPJRinwmkaPTDSGMWz1keVOG48_I_vwEqAwrRQS8Y-G2wO55Fg_ywYQNjyhsqvaHARMhrNKRrmqNRJbEhR3DIin2kbzLkwS34kVt0cMvaPhzD0VQx9p2FP8FPHPdrs0f3XN5tVpJr0Bb0Ka9gAIPXMuDjf9wCQxmL4apRsKK7YkyWX4KK9gZ_tFjDJWJxvpaCbRw9NOoHGwAl3b-KGKvJXpfZ5lIUlR_A1r7N8AMDVmEusHw7qAiWOyDxSueEoDVOnH6RsjYuGGt4MuA-MkY6NbpfUilMI8hEvysyurlzy5tCkb_8-WkDw5f4vwU1PDB6e_EJJHY7OvxXxeu4_1ituIFF62I-6x8vx3I3PrvLtfklC07ODRqOr1ACEkxbz3ouLJfNBgFjOASFUoGXIofnkxomZJbBDRMLfl-5GcgoL0crHTytvol3Grffy_WrxXflX6Fti_Kw9hD44bp7JMYYD1ByfwLqdtlhezoZB83QQYukWIjmU6BXeTFbDgGd1ocRS9LNxDJ0Pmz9Nkm2qR9TLZ2ZP7SnnUS8-7PHLpxY36yKlzhiv7bIxCrN0auaqOX98ms-fmLg6jBbxPiQN6nyiWKWXeWwJP9tK2oSM1WSaZn-dkjM_vCtDGt5kGs8eeSmkWBVK5XiGkR9nnngJtJ88iBEOSgbH7W1XFNoewXO2bD3FJqdEFWifIsKqLq28rtTASU1D8xUhISWHM7pjz1exkPc62s0XuTBpErV9wMiNibRtPvQy9rZKXddDMAYi0hcQmxaWHuykP2ESgVWlKciaWTuGZnwGSwAhFlvaU5V4KiQ-EqT3XCzPZdHTlnXXyA4CDDfrGviPAHscNMPtAQH8g9iNUI812aeBawWDSDD4twM1kT4WTVJ019FnI6FMstrdEHCUvoQVsHvWOw8E1ANpD0UIcogiOcqBr-mKapu11tmS0YuALzhXc4jQRvBghL6QhRZ5SLgxu94CK8GZn7j7b5kIC0Qj8f4xSvukpugqaGByu5DPqxFNC_7ssfv1ATbvJAry-db-FJE_Vzxlfd38_L6Wy-S9eSJfgO66oI3fkeEwgamP2NMo2fjkv0KItqAYmqkfMFfpUU-8biKnMSc71ZasTjTFgG00DWjhujrmp9Zkv-6bkvQnqfZWtC0ZCODejfpStF34h3PjzQYSdzBIKWvEeOO6vPKJ8RHZ2lHt-9n2xxQEo41t-HmSTpK_0eyVZnb5xdH2JJJnuN3ICasp9-4Djd2SII8qRJ4AeD6g1V-Pt6Hgi-l4MGLnZg4pJj91M37_jYD6WrbuTkzbD-qcUFGQQ33CtcTQ8p-sfmxwZnE8L03iHsI95Fll-5kDhZMUk5GY5WpKkh8PoSz_y3RPC0tX5AEYQC5oR0_KinZrTcpxi-Rapglyu5zxNvGOflnG6nveTKHshd0HnkCNvAa3oxcHPMvMBH6nexKaXjLAO4iQyfqywLuLOGDppP6Ar3qQCP6BS-4IHCRFm5ZL_CZD1c5jqyLXzYaQGuqCyoNuR5UsNwvIfhwizgmbbb_j5JWyn6BmZMZik6Drt6HBPXhjNVWGeCdHV5HXpXZTcwkAPJZTw7vxXlbH4keEMQpt7U8dnSPy0_Lz0je9dr0Ic3M8d-lo9ZUeNqEQqeZXq9O5Cuj1H6GkiIigFcVJny6EXAwP-T4w6Jep3bGyKCbOWpe_TIZyWZl7kM6xF7VedIoY1rt8qdVPfYd3CVkH9UxHWHtkjQKOpV3tER0UbZDxqG4IA3MNmIJ7BiBuLEYvs0AXMzS0OB8_0rKjQQwxp3RJfUJ6UqfY6lUk-VOXdK3MLdajzF_KOHNhl24VpKwn9a1CzMs7Pbdu3Ii7qrjuGSXzy88krXjfDl0XIUV-ST3Ye5FWbhpx67MX8PoP6PaNDhldZ7X-GILYUMyJg50b6gh9PuGQSHzncIzXMHNavOP1vBNEg7oIX2w2FW_ont0BQ393eiT_Dzme8J_dgR8yomsi1Gw9dEorzmCbvcqldj6VumfeNsj2MfXTi13OZjEWuxVuURr1IW0fhS4IrMtjOAXMFvl-KKbP0shMMYy3JgvjXJ66zCdVX5Qlc5cI3k2CCQ&cid=CAASEuRoceDhdNu-LXQZmL23hlQy9w&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:45 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame 3598 24 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:22 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3B9B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

69ms
69ms

Document
text/html

2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 13 Feb 2022 14:52:32 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 13 Feb 2022 14:52:32 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sun, 13 Feb 2022 14:52:32 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame 8565 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 06:02:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 06:02:56 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2806 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B-fz3LxsJYuOYKtyw3gOatayIAQAAAAA4AeAEAg&bg=!jI-lj8vNAAbAtJCDwLQ7ACkAdvg8WufGLmV7_av2GH38kpe12byC8CDrg8iLHJbBogCKNSchM9YKZgIAAAFxUgAAAAJoAQcKADZqwcP0UZUZAIyBSN7C020MIfSYmgoW21dPzj7ylEaYRt6_sae6aydL4Phll6WjUngL5s-HReGZAwHW0_gNezs1gUR64CKOjmvnHDW0sDWCGifGAfP8UQfpCN4Bf43MEZxLOEYrlYnZo4PQKcTtB6mBFFC8gFVBkJswMRl0fzMVsKawEQd5UOizlJqq1u0TyvKnqV-sEaE5QN19TVtaW_Aaxk81bqdT1oXOpAI0EhDl4Us3QSGplpQHTJYdFztiBChRGvJUv70W1_5jJB3U0dXpDwCmLCrfrZycs-Gxyg2lLISaGlzdwLZXWvd6-KSiq6lEgKoQABB_IcBP_KjvgVP3A0s0q3Hk29I2VwctktgUfPWryPbay-NDT60YnP4f3I8neGjr0hzBAtZE0OttIQxpAyaTub2DiFRsXtjtIG1r3heZxXEvlrjC8NMKL-Mt3HBzaviTB2NHsplJfSfxHQfiqFrFy473BWntNgfUFJ-Wyn2FBXFR5yML1m3y1zOzSCx4rk8aZLBbXASwzq4ErfOGggndStqNTJQ8qd6T94DsfsnQOgKBC93I_S0xvP7wdX8XGTi2DnWJrcgoVAbQC7JVyAAGCdsAPgnBEw9gKDnn_aVe6OQ2aCz4hza_V4ii3MsnFjQ9rCnS2KNmyJxGQogTcJHebmSFXkFFci9j2MqxFEVIMaUFZ2sRBLaLa7Fdu1DxlC97jW3Ni6E66lxdnxL8QlJN3BWrWW_2iMB6mDuUtcXoMpi3zLF6fF6lImJIIQGdiyIVyHfd67bIjnabWxvxgJ4QcsFIhXQSL9Uqj3VYjqRw2YHmdFtshx9qDhCsBrH4TptoptSkVnHxl0ylM2Dh8V9OIy0XLh_i7ETNQsemdAWEzKVXEh3pbJY6W133ob9c0KBjoVnzYq0MllTgl-HpYgAHeYQ6jYfL3hruw_N7TJ7fHJTgreDyhZxXz565ZbW3XumSZg4e5bTg5EjrkFKP0z4M2bT9_p-LuZZbDIWzCExhILFwJUSwfUWzuXum8j8C_Eon40sTN-p2C0-Sv4kUOjNPdPg4zRW9WrhqI56dr4tQ5jN7NEJOwHiXwTE6CJ0GN2wVcojK9rHj

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 3598 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53556
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Feb 2023 23:59:56 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7D78 1 KB
749 B 6ms
6ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Sun, 13 Feb 2022 05:53:44 GMT
expires: Mon, 14 Feb 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 32328
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 3598 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 588cf3902e0df22c1d81fd401ed18e218c7b884b3950467b7f6e5e38c24a3faa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/ Frame E038 110 KB
25 KB 15ms
14ms Document
text/html 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2cde85accc22e4dd229197320f6625e3a9d033fe5c577bbdf47b9619a9621412

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 25585
date: Sun, 13 Feb 2022 14:52:32 GMT
expires: Mon, 14 Feb 2022 14:52:32 GMT
cache-control: public, max-age=86400
last-modified: Mon, 29 Nov 2021 10:51:19 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3598 0
24 B 49ms
48ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssyxWYPp5IY2kKaGsH_-DSEkMacd6eMZnrfOE81yYpt6LZ-d5tpB7NMl-INgJkzPKCClc4lYzs2iU_bt2Aa26XxH_j2WbDixngOlZ_i55egwyEpjnBP-4k5T_pKJIQ16_pNfITtqPzO8qlV2vXRQzaYWKDPkughpBQoi-p9j7kEj_Y7NmcAKhJGelsYQuAdT_5RJ6dTyp6MiTva76vllwDW6Ij0RRJULMu3aIhdpi58q-P5ZfxTK0p1szwcjJQSURTkZ9bjpgsoAfIKxC87zvw6fmv2y4uwZA-KGq9bJGSZwF1-geOuWlLHUz4YTA-jdnBnK2DAkncwkbINZiMu3smvi4YFsKYogEVc0dKLaP8xirpoAkD5qwaWDcO6PNk7kE5fEXxP3C5fNdJx_5NFMdyJha2txWLk7kUGHOx5k3Eww8YTKURlPnE34c2apVBG19xldczbGme_a_tCxpKI0OMwVg4yyxaNH6AW2aYqDdtpNf0uZhTLMAxPx2GbKaLfpxGPZDv92SX9B5xzrn1Tz3JfGCziNzk_pG_FMy5_3G_ggb-l-ddhI6C-YdwLrIKv9IuGUHLs7-5ypRnqqAEjoTAYJMbOMJnRXDXjJI2bZfoUevj8OJ2RAtABT08Cx2GimY_SZQJ52RwCPCyaDqiCXCtbSm-0UeLezr522w7ET1PRPfRXT2DoDreZEoNPdoie9UAX0zuUA-LKqN4XsGJ1IqyIvVibL4NyLkK9KbHYdTgU3O-Eq3cvkf51VmBvbaJeMKUdwQtmq50EZF1EWjK0c-LBQlncwTFQQ9AvCKp7RdbyIjNwoce8R8V-Qn6jUzLTAwJw2l9Z_iAj29I0i8EPjVM2QHMZVi0MYFZOGWT_7uv9lL_xyT_CEmkzJHkS_IVPK4fqz3hA15rNDzVba5EiE7u5ck1d97h7qEDF03fd-Y8SnaVk4D0SjxSQbG6jeco7nQJE19oyJqX_pqsjze1QzF07w4sRdR9898Xko7vKpyFM-68agCVcXI5w4SR-WUr5YyCBbY15vA-MmYA4it01edZI3kgLxyh62-23B__M4uOdd2A-XktKk09-tDSrD-hTB7sS8DrkMwqeRqylJV7HA83BIxsJsoN9QyBaUoX37Uoxs-d48QeOEhFmO0S2UpWhX6ugyE30tCLppfNzG0qS9lyhNx5TYFt7azwdWADA_mnB&sai=AMfl-YRzxMFtgZxt5TcPwODU8RRCIIVUn9oaj1unsThb-RHBISCTniwCbWQAxM8RjIHNk18Ky4CXFRebxIQDcUXeg6TFetb_S5etKXQouty8qF-g5Hg5y3I6Yx5R1XZr3BgiLuiMGiCI5Ff2VrlA1aB0KVfPK7xZIA&sig=Cg0ArKJSzOvbJViJ8ULMEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=180&cbvp=1&cstd=175&cisv=r20220209.42274&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 13 Feb 2022 14:52:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 207A 43 B
215 B 203ms
203ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=895631&asId=9c8d00c5-f989-d5d4-4ef4-31ff7dae9bb2&tv=%7Bc:473iIS,pingTime:-10,time:607,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85OC4wLjQ3NTguODAgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1644763952637%7C%7Ce29143c379d7f67621ca346abd0ae497%7C%7C920bd99aa4265c459f442b819dba176b%7C%7C544a1df6dc914af2a08c47987ebd387c%7C%7C7024d2548d598d74ae683499b78f2048%7C%7Cf0f93e9c9cda9b4950c92645099c6ab7%7C%7C1953e602b9e66f080d752b15e8d8a3b9%7C%7C35ed755af8eed78d85af352186d015d1%7C%7C1629390669%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=280&slotname=2118397659&adk=745827064&adf=3235933448&pi=t.ma~as.2118397659&w=427&fwrn=4&fwrnh=100&lmt=1644763951&rafmt=1&psa=0&format=427x280&url=https%3A%2F%2Fyifysub.net%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951129&bpp=2&bdt=184&idt=157&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C883x280&nras=1&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1043&ady=1610&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=xTY7qzLU9u&p=https%3A//yifysub.net&dtd=159
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt09.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0874 43 B
215 B 196ms
196ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=901669&asId=3e6ee2e5-14ba-b4c5-6b10-be68465076da&tv=%7Bc:473iJ0,pingTime:-10,time:564,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85OC4wLjQ3NTguODAgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1644763952645%7C%7Cd8829f3be646f50941a16f91f5140016%7C%7C920bd99aa4265c459f442b819dba176b%7C%7C271591b527feddba55ee004ebfc1911b%7C%7C080d4491bea23001341f93cde3818c21%7C%7Cc47596ab57f01c6860a7299825981366%7C%7Cf84109f5dca48542ffc0c8a0f8cd0815%7C%7C45965168245872dc45cacc0a7d7e7764%7C%7C1629390669%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-server-name: dt12.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame BBB9 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 48976
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame E038 118 KB
40 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 15:15:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85022
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 15:15:30 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DCC5 42 B
64 B 58ms
43ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssFl0u9PCJnvI4SY6rEl4mnXFJJqaed9wLofkq8ofDdW-dbhQE42P1rpqMr6ono-Bv5rzbiprSkW-qZc0jMaGNwYuXKCniuUs-EhaiExa8_rOhzqUWiRA&sai=AMfl-YQ4mXAOUYvRp30tnUoYwb-Zc65CgETz7uFubAWjxqvGCGCKbn5tu5-z3uOKzxGogsnqVBKaeKNJe7C1&sig=Cg0ArKJSzKhXlVuPMWC4EAE&id=lidar2&mcvt=1019&p=0,1,227.59375,884&mtos=1019,1019,1019,1019,1019&tos=1019,0,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=1949448543&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644763951512&rpt=130&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7D78
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJxh3qp9UbbsgXsaJr73B2E2lPNFxhStp4Gwus...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdrYk1BQUFBYUR0ZGhiag&google_push=AYg5qPJxh3qp9UbbsgXsaJr73B2E2lPNFxhStp4GwuspkGFcFJOiipfZxgfV28x8QSTPttfXGCmX_MTi3LpE2o6B467mMn3KmgnD

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdrYk1BQUFBYUR0ZGhiag&google_push=AYg5qPJxh3qp9UbbsgXsaJr73B2E2lPNFxhStp4GwuspkGFcFJOiipfZxgfV28x8QSTPttfXGCmX_MTi3LpE2o6B467mMn3KmgnD

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdrYk1BQUFBYUR0ZGhiag&google_push=AYg5qPJxh3qp9UbbsgXsaJr73B2E2lPNFxhStp4GwuspkGFcFJOiipfZxgfV28x8QSTPttfXGCmX_MTi3LpE2o6B467mMn3KmgnD
Date: Sun, 13 Feb 2022 14:52:32 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7D78
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESECeu9KSNS-bAGgjEo770kpo&google_cver=1&google_push=AYg5qPLtLS73cCcLmEftHDG4xFiHUlwasM5rp7CgeVxPTuA-rdOLhRwAlKmTzCCdEZ7AtJRuiLcoFIPgHy2bUiumeWddGQu2Hkyy
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLtLS73cCcLmEftHDG4xFiHUlwasM5rp7CgeVxPTuA-rdOLhRwAlKmTzCCdEZ7AtJRuiLcoFIPgHy2bUiumeWddGQu2Hkyy&google_hm=Q0FFU0VDZXU5S1NOUy1iQ...

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLtLS73cCcLmEftHDG4xFiHUlwasM5rp7CgeVxPTuA-rdOLhRwAlKmTzCCdEZ7AtJRuiLcoFIPgHy2bUiumeWddGQu2Hkyy&google_hm=Q0FFU0VDZXU5S1NOUy1iQUdnakVvNzcwa3Bv

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 13 Feb 2022 14:52:32 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLtLS73cCcLmEftHDG4xFiHUlwasM5rp7CgeVxPTuA-rdOLhRwAlKmTzCCdEZ7AtJRuiLcoFIPgHy2bUiumeWddGQu2Hkyy&google_hm=Q0FFU0VDZXU5S1NOUy1iQUdnakVvNzcwa3Bv
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7D78
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPLQNHj5ImrFQcztVBZFJqNmI4NRCBftJgaHdD4IkEmxXlHVOcVbsGsl7Opc0NjaPWITW4VCRqhGlmGOk_Qf0V8oKJlJeOn4&google_gid=CAESEOgGuesKngR9_1f_PAbqpxs&goo...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCLC2pJAGEgUI6AcQAEIASnBnb29nbGVfcHVzaD1BWWc1cVBMUU5IajVJbXJGUWN6dFZCWkZKcU5tSTROUkNCZnRKZ2FIZEQ0SWtFbXhYbEhWT2NWYnNHc2w3T3BjME5qYVBXSVRXNFZDUnFoR2xtR09rX1...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwaDAtZU9oMnRPdGNYOHhUbHd2U2wyc1JkajN0T0M1TWhwbF8yLVFRUHplbw==&google_push

170 B
188 B

34ms
33ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwaDAtZU9oMnRPdGNYOHhUbHd2U2wyc1JkajN0T0M1TWhwbF8yLVFRUHplbw==&google_push

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 13 Feb 2022 14:52:32 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwaDAtZU9oMnRPdGNYOHhUbHd2U2wyc1JkajN0T0M1TWhwbF8yLVFRUHplbw==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7D78
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJoGpS3...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJoGpS3...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAyMTMxNDUyMzMwMDA0NDIyNzAxNDQ4Mg%3D%3D&google_push=AYg5qPJoGpS3XUv0sV2zxuvEX-gT_eJGj-_uO2ks3YcL6rVkuuQ-kuV8RXp3Xemi8ZN7fr...

170 B
188 B

33ms
32ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAyMTMxNDUyMzMwMDA0NDIyNzAxNDQ4Mg%3D%3D&google_push=AYg5qPJoGpS3XUv0sV2zxuvEX-gT_eJGj-_uO2ks3YcL6rVkuuQ-kuV8RXp3Xemi8ZN7fr8DurWdxrQO4YRn-nI5CFCxGWMEdw5u

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAyMTMxNDUyMzMwMDA0NDIyNzAxNDQ4Mg%3D%3D&google_push=AYg5qPJoGpS3XUv0sV2zxuvEX-gT_eJGj-_uO2ks3YcL6rVkuuQ-kuV8RXp3Xemi8ZN7fr8DurWdxrQO4YRn-nI5CFCxGWMEdw5u
pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Sun, 13 Feb 2022 14:52:33 GMT

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame 7D78 43 B
324 B 33ms
16ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEIOhnlqpSEx3MwpDWCrgvn8&google_push=AYg5qPJ5c5FwTeZuJMUz5wo3tv_9Wv1LFpQyINm2VSegRz8u7MoIraIFhmYxnN6Trl1UvntVzhkggF93260AO5ifqrh0ujqho8tL&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET

pixel
cm.g.doubleclick.net/ Frame 7D78
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgkbL0stH6n6-sY06wEZzQAABF4AAAAB&google_cver=1&google_gid=CAESEN9nxxDips4Kz-KPJFvQsqk&google_push=AYg5qPLIaba3Zd6TiCwtbCFySupwVw2sBQsks...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7D78
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEAzoH1ZLN4AcL40wq7QOReo&google_cver=1&google_push=AYg5qPK49Rwzm-QWZRY9pGBW...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK49Rwzm-QWZRY9pGBWANt49C6To0sG785XiHJuSmLhBpSY01b1qNTi3JDajgWV32_0MoaINnavKxUfvXE2KlzM_1dLRC6lqQ&google_hm=

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK49Rwzm-QWZRY9pGBWANt49C6To0sG785XiHJuSmLhBpSY01b1qNTi3JDajgWV32_0MoaINnavKxUfvXE2KlzM_1dLRC6lqQ&google_hm=

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPK49Rwzm-QWZRY9pGBWANt49C6To0sG785XiHJuSmLhBpSY01b1qNTi3JDajgWV32_0MoaINnavKxUfvXE2KlzM_1dLRC6lqQ&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sat, 12 Feb 2022 14:52:32 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7D78 0
12 B 14ms
13ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IJbBxrusQrj-Mbnx2QFMaxErFDPLPmggV3ECxJQIrHEzZdHaIUS7JiQwRv3A9HQgbkdPo3Tw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2261953515587717&output=html&h=134&adk=2386760996&adf=635788555&pi=t.aa~a.3087909037~rp.4&w=883&lmt=1644763951&nsk=e2d45fb4&rafmt=11&pwprc=1471026236&psa=0&ad_type=text_image&format=883x134&url=https%3A%2F%2Fyifysub.net%2F&flash=0&pra=3&wgl=1&fa=26&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1644763951576&bpp=1&bdt=630&idt=0&shv=r20220209&mjsv=m202202040301&ptt=9&saldr=aa&abxe=1&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&prev_fmts=0x0%2C883x280%2C427x280%2C883x134&nras=3&correlator=119107143287&frm=20&pv=1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=130&ady=1699&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531398%2C31064742%2C31064780%2C44758227&oid=2&pvsid=2421225799939648&pem=570&tmod=527055983&uas=0&nvt=1&eae=0&fc=1792&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=3WeMFSwLod&p=https%3A//yifysub.net&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:32 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8A19 0
20 B 44ms
44ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BpkDCLxsJYoTZLc-B3gOehZSACQAAAAA4AeAEAg&bg=!rK-lr-vNAAbAtJCDwLQ7ACkAdvg8Wi7blESrEd45H7e_uUkiB1R9Cf6QnrUrZ5tmBiziSVOEXfTe4QIAAAFbUgAAAAFoAQeZAwfzDEXZiYVQa4YzAqU06VYq4PD_e1pvUGkwRomSSqmkgDKRXme1BQWNxC3biInH7fItDlnRUoAOPQIeHcvQe2-UZv3LAXH-k-tMOcqip-jve8ukR6-vSYFm4bqrSgJXnF6YCUdWJkNdupOjL26DCgA0SQzWkI2Z-GqwGMP1u_cQHBgZXh6SjPbZrq8idNLF87O6VPApFLQbY6L_1JLjVAlrjezu1x3jUB4cxnYd7nfzgInSlWTZWxQ1ijBg0fDVvDhKzcuxgOX9hVvFPtimBdrxG_6JLwTdj_1R4tfB1J7PKCEz1SeRHR3DMcATtcDGYY1QKGyzpMnPydpqnf0wR_Y_w07z01LY0TfmkaZSKGMYl-0z6fH8gnyRhDAJTbgZHujK378HSCtz-3G0c2Qaeh-o_XuOTbI7BsKuZFtkqavRXts67UJXp2i2tnGdHFMUGpqoPVUGTlMajO-nX04qpT9xhLeCOXKS6XVIutevrfk_-QLPhkrgMpjlqsEwTrFVAQ8h0IcT7jtCu7oWp7PpLt4X2rihsYHMO3048N2-FXNmAVMtfPTQVfX4b58oBSPLnER23bdXqkcZ6S0I4JCdVe7f22BepxlRBIm2jIw_ZOGO0-O9VmqpKumIHhZ3N27ak6yiEvEhpgizODqUrcn2QJuHw5rZggRn3aMBglgGuAr6JIX9foJleIx9O7UNH2Y2kCt_bYzGWaH9BbZSv-z0WfUR3aoMEFS9__j0IcLLMkzTUoisukVXSfNoq951jxWWXnMx2bJur2ANoBlPGVNZSz4cFMI0M-a1JgCtm2f0c7ZvmL7rAVgpH4whxyfHAPiImP2GqVzhg4oTvQYeyQm_nZBlU6j6eSxjg-18hRlBJ9qr1Cv7HV3kglgL3-Eixuf330OUfvjrjjXNnMd9PGDfKjXKm6G9rRI8zXxdjhdP3Xd_1sSjakhJEfqDImQ7lZ2epCZ5-ocgBZ73UowxQmyTnr-qRmKpx2baeh7aoI1Zfh4xfqV7hxHI9c2_EtcX_Imop2RYTbqBGllE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220209/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 btn_cta_arrow.svg
s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/ Frame E038 696 B
461 B 7ms
7ms Image
image/svg+xml 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/btn_cta_arrow.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bea7b7559e0ff6a9c67d5b7d58da3cbdc923c11b5af02067cc26f0d72465b387

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 00:05:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 426
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 10:51:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Feb 2022 00:05:35 GMT

GET
H3 200 kia.woff
s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/ Frame E038 23 KB
23 KB 8ms
8ms Font
font/woff 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/kia.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4974622fff31e0fe9dcc6c31c33e3f74dfb665d2678bd876ab807506e3bab60c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 19:42:34 GMT
x-content-type-options: nosniff
age: 68998
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23072
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 10:51:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 13 Feb 2022 19:42:34 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3598 0
23 B 46ms
46ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssyxWYPp5IY2kKaGsH_-DSEkMacd6eMZnrfOE81yYpt6LZ-d5tpB7NMl-INgJkzPKCClc4lYzs2iU_bt2Aa26XxH_j2WbDixngOlZ_i55egwyEpjnBP-4k5T_pKJIQ16_pNfITtqPzO8qlV2vXRQzaYWKDPkughpBQoi-p9j7kEj_Y7NmcAKhJGelsYQuAdT_5RJ6dTyp6MiTva76vllwDW6Ij0RRJULMu3aIhdpi58q-P5ZfxTK0p1szwcjJQSURTkZ9bjpgsoAfIKxC87zvw6fmv2y4uwZA-KGq9bJGSZwF1-geOuWlLHUz4YTA-jdnBnK2DAkncwkbINZiMu3smvi4YFsKYogEVc0dKLaP8xirpoAkD5qwaWDcO6PNk7kE5fEXxP3C5fNdJx_5NFMdyJha2txWLk7kUGHOx5k3Eww8YTKURlPnE34c2apVBG19xldczbGme_a_tCxpKI0OMwVg4yyxaNH6AW2aYqDdtpNf0uZhTLMAxPx2GbKaLfpxGPZDv92SX9B5xzrn1Tz3JfGCziNzk_pG_FMy5_3G_ggb-l-ddhI6C-YdwLrIKv9IuGUHLs7-5ypRnqqAEjoTAYJMbOMJnRXDXjJI2bZfoUevj8OJ2RAtABT08Cx2GimY_SZQJ52RwCPCyaDqiCXCtbSm-0UeLezr522w7ET1PRPfRXT2DoDreZEoNPdoie9UAX0zuUA-LKqN4XsGJ1IqyIvVibL4NyLkK9KbHYdTgU3O-Eq3cvkf51VmBvbaJeMKUdwQtmq50EZF1EWjK0c-LBQlncwTFQQ9AvCKp7RdbyIjNwoce8R8V-Qn6jUzLTAwJw2l9Z_iAj29I0i8EPjVM2QHMZVi0MYFZOGWT_7uv9lL_xyT_CEmkzJHkS_IVPK4fqz3hA15rNDzVba5EiE7u5ck1d97h7qEDF03fd-Y8SnaVk4D0SjxSQbG6jeco7nQJE19oyJqX_pqsjze1QzF07w4sRdR9898Xko7vKpyFM-68agCVcXI5w4SR-WUr5YyCBbY15vA-MmYA4it01edZI3kgLxyh62-23B__M4uOdd2A-XktKk09-tDSrD-hTB7sS8DrkMwqeRqylJV7HA83BIxsJsoN9QyBaUoX37Uoxs-d48QeOEhFmO0S2UpWhX6ugyE30tCLppfNzG0qS9lyhNx5TYFt7azwdWADA_mnB&sai=AMfl-YRzxMFtgZxt5TcPwODU8RRCIIVUn9oaj1unsThb-RHBISCTniwCbWQAxM8RjIHNk18Ky4CXFRebxIQDcUXeg6TFetb_S5etKXQouty8qF-g5Hg5y3I6Yx5R1XZr3BgiLuiMGiCI5Ff2VrlA1aB0KVfPK7xZIA&sig=Cg0ArKJSzOvbJViJ8ULMEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=319&vt=11&dtpt=139&dett=3&cstd=175&cisv=r20220209.42274&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:32 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame BBB9 35 KB
13 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 06:02:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 06:02:56 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame E038 7 KB
5 KB 26ms
25ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

756bcdbbb24716fc642ee59eb0536e5356733f02593bc1e9b671eb2c19316168

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5524
x-xss-protection: 0

GET
H3 200 logo_kia.svg
s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/ Frame E038 1 KB
709 B 10ms
9ms Image
image/svg+xml 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/logo_kia.svg

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4caec19fb48c8b123d8f1dd3443f2bd70863adf6408db3ea83b1ee46df65c454

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 00:05:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53216
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 674
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 10:51:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Feb 2022 00:05:36 GMT

GET
H3 200 23717839_20211025053754467_bg_01.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame E038 14 KB
14 KB 11ms
11ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211025053754467_bg_01.jpg

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a298013dbdb4c2fd03dd00d73b1e25c072a6870c88b715abcc177c430742d8e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 10:40:08 GMT
x-content-type-options: nosniff
age: 15144
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14099
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 12:37:54 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Feb 2022 10:40:08 GMT

GET
H3 200 23717839_20211025053757789_bg_02.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame E038 13 KB
13 KB 12ms
12ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211025053757789_bg_02.jpg

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f11804d1ef933b0bc1743a89e33afbd528eeda107a6c0c2444be61d739af5a73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 09:40:03 GMT
x-content-type-options: nosniff
age: 18749
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13509
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 12:37:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Feb 2022 09:40:03 GMT

GET
H3 200 23717839_20211025053800857_bg_03.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame E038 18 KB
18 KB 11ms
11ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211025053800857_bg_03.jpg

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

568d6d51abf60ead0a44ada316a65a027f6c172b194e3858ae0fe30c983c857d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 10:40:08 GMT
x-content-type-options: nosniff
age: 15144
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17922
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 12:38:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Feb 2022 10:40:08 GMT

GET
H3 200 23717839_20211025053751068_bg_04.jpg
s0.2mdn.net/ads/richmedia/studio/23717839/ Frame E038 15 KB
15 KB 12ms
12ms Image
image/jpeg 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/23717839/23717839_20211025053751068_bg_04.jpg

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04a06dd9dfb3eab995476062839b8367ec2586183fdef7e93d08994db0a50654

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61883558/20211129025119785/index.html?e=69&leftOffset=0&topOffset=0&c=vpnrFDurvh&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 10:40:08 GMT
x-content-type-options: nosniff
age: 15144
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15494
x-xss-protection: 0
last-modified: Mon, 25 Oct 2021 12:37:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 14 Feb 2022 10:40:08 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame E038 17 KB
6 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:32 GMT

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame 3CBF 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 06:02:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 06:02:56 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 23ms
22ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220209&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d365b1f8d5bc9861a9af07b3711ab784a4b4b8c39a7b3015a3fe36224c6f9295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9791
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:32 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 867D 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 14:25:05 GMT
expires: Mon, 13 Feb 2023 14:25:05 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 1647
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2AF4 783 B
534 B 16ms
15ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8d9d085c13920da74e1a9e281205467969279627239cd21d036015c2050cf608

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-/Rksgwv+Oh8u3gDnLL5D7g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 13 Feb 2022 14:52:32 GMT
date: Sun, 13 Feb 2022 14:52:32 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-/Rksgwv+Oh8u3gDnLL5D7g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BBB9 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BdjusMBsJYtrIErmCjuwPhsCIqAQAAAAAOAHgBAI&bg=!BwSlBEDNAAbAtJCDwLQ7ACkAdvg8Ws261cvMn8MKd8nxqmmYdECAMEh63UrhcCf7LV-qjQZGyK0NNwIAAAC_UgAAAAJoAQeZAxRU5XuVLt9XwohegE4cza5x4OvsXKqV64OvvBnxbRQVyUlaJI-FBWx1gCk0GEmdig_nJSjPENoY4q5gXQa8nbS8QE-qeNxppO948NomWTsaEk8Z7og1lu6SJICpqc-QwujNukECHYSSSmTEB6KDDhEARhZdhbd63s62tFyk_u41RghlLzpQzicjP0ypBTxx7YDzE8t6AaoIDcaBDmiutbJ1iCV5ft_UQMMI9AwzFIfFJAVovGQXYP1JXtutFU2Wb5cp7yHyhbaY-6vNcjKtbFu0jUlONgrodAXnBJs5bHtDJ1izgUFR5NWNsmd5-5YgeoFPYjDiIR26cpF-6nKI4BDmiz9amjDXGP6NrsEqf_Yyh7Hb_-nLmc27os_1anxigBCtH8vEyFC6Yt6dcMNY6wmIgZrIFnTmfDxQ3N34btYWaFvxlWpzBEvnfmv_BMmMoznLtQvMm7CKUzZRy0RvEa8QPbD0IheiLQEBTUXVvZVvUfB1GxJECyc_cFYbarZu2X4L6sW5wGoe8dTPe2h385TVltewbTXSztPUX5rAahwnej1TdaBnpH6PXBopsyp06WtJJkzSrQMb62Rh3t3o4irBgnRRtyCiiXjPpeRTHxolCNl4qrIU_Iqrfkh_QsHToRhQqAUbWxiVpAeDMHUMweCex7sZo6oOwwmplATUOGsYuu_iWU11-TSULw2149ps8j854IbNOTO1TKZJ4rNdSiAS6yE_ZvHkYFu-Uvrus-qs-HmX4F_YJ4yVXu3S-eSx2e1TKmtSz6ymOT6eT73vJHDypBxwiJP2oJPHygjat9IMLXEhT6Ty8qsq4hFBDCYVEW7YDdq9-_1lQGZuGNQAvSgQT8RvJ3zBMUqJRyx_Sf-SS6yUkugLF5H05pMJONEFrrHxHwtDiCHwEZF6fNevRVgAcNG7XcoTlov37YFgpGPHuiiakuFn_kQGsy1TJdghU3swbLQIMqGp61XnIn8Swzhzn2cpanF8hQDm68_px0b5-DTLZ2cFvlnBIaVwHsOJLHuf5gVL_eRDpCFIKpaDLm_dJ0e2NQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2AF4 0
0 55ms
55ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220209&jk=2421225799939648&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js Show response
pagead2.googlesyndication.com/bg/ Frame 867D 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/PUCLGob25V5To4ZA0QrG8QFJpfKRC6B4XbMmUjSZFR8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3d408b1a86f6e55e53a38640d10ac6f10149a5f2910ba0785db326523499151f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 06:02:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31777
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13483
x-xss-protection: 0
last-modified: Tue, 08 Feb 2022 16:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 13 Feb 2023 06:02:56 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 207A 43 B
215 B 156ms
155ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=895631&asId=9c8d00c5-f989-d5d4-4ef4-31ff7dae9bb2&tv=%7Bc:473iP8,time:995,type:e,im:%7Bpci:%7Btdr:826%7D%7D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:995,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:21,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B988~0%5D,as:%5B988~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:234,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141*.895631-58886992%7C1411%7C14121%7C1413%7C15%7C16%7C171.901669-60420920%7C1711%7C1712%7C1713,idMap:141*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
x-server-name: dt09.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 867D 0
10 B 6ms
6ms Image
text/plain 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?YeoGdA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0874 42 B
64 B 42ms
42ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvq0LgIU9U7XNBy6JZUH2LIroqoSQFXn8uozPizeuaFLgP9cH2vJwCmbHQ7dDtUAlzHAw_oiRVT9ROjiMLQpBlxUzI8aPQd5I4R0uGRXKdGnM_J7Fg21w&sai=AMfl-YSukS0X9l1mIKkit_u2anL5xZnsHB4KVs2DgyEFQmFgPTeEdnpEEw9GV9zbl3JW0aYXyiedgHja4nlD&sig=Cg0ArKJSzECzJz4hX6iSEAE&cid=CAASBORo6nA&id=lidar2&mcvt=1001&p=0,0,90,728&mtos=529,1001,1001,1001,1001&tos=529,472,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644763951711&rpt=471&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0874 43 B
215 B 158ms
157ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=901669&asId=3e6ee2e5-14ba-b4c5-6b10-be68465076da&tv=%7Bc:473iRX,pingTime:1,time:1119,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:17%7D,%7Bpiv:71,vs:pp,r:,t:119%7D,%7Bpiv:82,vs:i,t:245%7D,%7Bpiv:100,t:629%7D%5D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:874,o:118,n:0,pp:127,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B113~0%5D,as:%5B113~728.90%5D%7D%7D,%7Bsl:pp,t:118,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:71,obst:0,th:0,reas:,bkn:%7Bpiv:%5B126~50%5D,as:%5B126~728.90%5D%7D%7D,%7Bsl:i,t:245,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B384~75,491~100%5D,as:%5B875~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:229,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141.895631-58886992%7C1411%7C14121%7C1413%7C1414%7C15%7C16%7C171*.901669-60420920%7C1711%7C1712%7C1713,idMap:171*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
x-server-name: dt13.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220209&jk=2421225799939648&bg=!ZGelZyPNAAbAtJCDwLQ7ACkAdvg8WmYMN_0ZkxgWGOF7GnApSln4Cfb2sayOFfu6Wqd2iEOVrHLJTwIAAABsUgAAAANoAQeZArIWVnmRD_ZVSktQFEeE6pu0d3OqSdWC70CI7gB07p2g8y2_bCzPCr_yBU-wGya4jHe780GXiFQacy8kuoyaYaEWdQBkwBrCswfNEB4At28zulHOsqEYz6uWWbDDGQiBcPIIIdC7UOuOZKG4QSCG_3wbItlcJyWbqSaHzneeUJsbi_wILjJM0N5G4piRrRlsQKuwFwRa6VQlcd-kVJ8IzwFNG9rsBiKk-FsjpEu_rFVN7susYYMk3cDrscjbsccZ9SBSgX-6ifOegSG7LOEPUZM1Gj56jdPnmYCh3yaAhfIFXHBzx-K9Kty9FltbjCjFqgwwOjJdu48AAfa7VJ917pXoYVJWyN4eQR5AY3UL6wxKuKtqn-C99x__03oq3MXU4cFwYLO3SjBClRwwIewhSvqBJiyEhGxuGYPwGvYbS9FOipPhjqV41_1xmiONIlA8l0zb5AuvziQYFi8oI5IxUD6F3T5z9FBJ0Daqh6npyKnYavYBLZRQVYNXX94MvXjq5UcmZNX28Tv2YI_2k0B7cmDkz7TZt0FuvD3vOh3aWx00mNCwwOebwo8vRwHE3fnoEl5xXjq6TNpoAnacdxbDJS3fb4RvbsnIUCnWeLPijh_bgI6Fsm9wzoeAxzgKzLvHH9aHPEHGdDKpHyTHGzeHBgBjl0lGTtKlS_CIlL9EZt0jeHRZTGKqYlytHKKu60hbqhI2i2jq4bcJvZXeJUdpc39VCIEFPJhKfhciIN6R-gYmS_RgDtJLo3huVFrrj_D--eKdpBayGPCIfrb9tDZheoMDswRxCaRQ48s90o8xYWdwa1uapQcEgvDJ-jo0bpAGpzsuGeh-jtjR8GB48G1Fz5cpLcNrUywOyNSXtK9IJOOZliYmeDp-VeVNivOMyDE8QgPXxy35ZfNUhYd4JIc0UF5QjpQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0874 43 B
215 B 158ms
157ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=901669&asId=3e6ee2e5-14ba-b4c5-6b10-be68465076da&tv=%7Bc:473j1D,pingTime:1,time:1719,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:17%7D,%7Bpiv:71,vs:pp,r:,t:119%7D,%7Bpiv:82,vs:i,t:245%7D,%7Bpiv:100,t:629%7D%5D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1474,o:118,n:0,pp:127,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B113~0%5D,as:%5B113~728.90%5D%7D%7D,%7Bsl:pp,t:118,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:71,obst:0,th:0,reas:,bkn:%7Bpiv:%5B126~50%5D,as:%5B126~728.90%5D%7D%7D,%7Bsl:i,t:245,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B384~75,1090~100%5D,as:%5B1474~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:160,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141.895631-58886992%7C1411%7C14121%7C1413%7C1414%7C15%7C16%7C171*.901669-60420920%7C1711%7C1712%7C1713,idMap:171*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
x-server-name: dt01.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 0874 43 B
215 B 158ms
158ms Image
image/gif 52.25.29.156
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=901669&asId=3e6ee2e5-14ba-b4c5-6b10-be68465076da&tv=%7Bc:473j1E,pingTime:1,time:1720,type:c,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:17%7D,%7Bpiv:71,vs:pp,r:,t:119%7D,%7Bpiv:82,vs:i,t:245%7D,%7Bpiv:100,t:629%7D%5D,es:0,sc:1,ha:1,fgad:0,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1475,o:118,n:0,pp:127,pm:0%7D,slEvents:%5B%7Bsl:o,t:17,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B113~0%5D,as:%5B113~728.90%5D%7D%7D,%7Bsl:pp,t:118,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:71,obst:0,th:0,reas:,bkn:%7Bpiv:%5B126~50%5D,as:%5B126~728.90%5D%7D%7D,%7Bsl:i,t:245,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B384~75,1091~100%5D,as:%5B1475~728.90%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:160,fm:sXkFVld+11%7C12%7C1311%7C1312%7C141.895631-58886992%7C1411%7C14121%7C1413%7C1414%7C15%7C16%7C171*.901669-60420920%7C1711%7C1712%7C1713,idMap:171*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,metricId:publ1,cmr:t%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.25.29.156 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-25-29-156.us-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:33 GMT
x-server-name: dt05.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 40ms
39ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=yifysub.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 37ms
37ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=yifysub.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 13 Feb 2022 14:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 36 KB
14 KB 398ms
397ms XHR
text/plain 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2421225799939648&correlator=4099545024173560&output=ldjh&eid=31064847%2C44757100%2C31064537%2C44758227&output=ldjh&gdfp_req=1&vrg=2022020901&ptt=17&impl=fifs&sc=1&sfv=1-0-38&ecs=20220213&iu_parts=162717810%3A22394807422%2Cyifysub.net%2Cinterstitial&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ists=1&fas=8&prev_scp=env%3Dprod%26site%3Dyifysub.net%26referrer%3D-%26protag_env%3Dprod%26protag_page-url%3Dhttps%253A%252F%252Fyifysub.net%252F%26utm_campaign%3D-%26utm_source%3D-%26utm_medium%3D-%26utm_term%3D-%26utm_content%3D-%26protag_segment_20m%3D44%26protag_minutes%3D52%26protag_hours%3D14%26protag_day%3D0%26protag_interstitial%3Dinterstitial%26pa_upr%3D0.00%26protag_upr%3D0.00%26protag_opt_u%3D0%2CX%26protag_proSlotId%3Dprotag-interstitial&cookie=ID%3D3288943957703d8d-226a6b093fcd0035%3AT%3D1644763951%3ART%3D1644763951%3AS%3DALNI_MZVSSFsA-KsLKBZqnsgDaDQv0HNNA&bc=31&abxe=1&dt=1644763956256&lmt=1644763956&dlt=1644763950945&idt=224&frm=20&biw=1600&bih=1200&oid=2&adxs=-9&adys=-9&adks=3631375421&ucis=1&ifi=7&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fyifysub.net%2F&vis=1&scr_x=0&scr_y=0&psz=0x-1&msz=0x-1&ga_vid=2094621581.1644763951&ga_sid=1644763951&ga_hid=1540554141&ga_fc=true&fws=2&ohw=0&btvi=-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8d23129f7101c70e6e8df23096c2872b6c870a13d6520601297dae4a48a0bd8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14152
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://yifysub.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1AC7 6 KB
4 KB 73ms
15ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 13 Feb 2022 14:52:36 GMT
expires: Mon, 13 Feb 2023 14:52:36 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pubads_impl_page_level_ads_2022020901.js Show response
securepubads.g.doubleclick.net/gpt/ 35 KB
13 KB 12ms
12ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022020901.js?cb=31064847

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ecacf7f3f1ce28107e37025ac15757466aab98fa3fe05f9b8d901edf9e794fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 11:48:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270217
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13012
x-xss-protection: 0
last-modified: Wed, 09 Feb 2022 09:36:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 10 Feb 2023 11:48:59 GMT

GET
H3 200 container.html Show response
35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 086A 6 KB
3 KB 21ms
7ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022020901.js?31064847

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://yifysub.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 14:52:36 GMT
expires: Mon, 13 Feb 2023 14:52:36 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css2
fonts.googleapis.com/ Frame 086A 4 KB
634 B 32ms
17ms Stylesheet
text/css 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 13 Feb 2022 12:54:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 13 Feb 2022 14:52:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 13 Feb 2022 14:52:36 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 79DD 640 B
316 B 19ms
18ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCM7Z4BGM-_jMEBMAE&v=APEucNWWeH3DVNu69EzGAl60usMRsGMBLyVQRRP8fpv9ZgBqPDzixz4XPW95l3rerm94bMQK40YPoK3pyuhkJMriHxy4FhHXcernCFrMAn7OzQq4Gt9XFnnR-atfTucCYr4p2x6KqCweUxJ57aQidB5zPw5lY-mVvdwKAhBRQupKMA-EC33adxc8vuTnIVF74ds1IRMS_aXIsCms7yOItVx_DHeInF22HA

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 13 Feb 2022 14:52:36 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AA23 65 KB
31 KB 70ms
70ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D8MQFWMiiXup-xt346OiuuwGRpDngXZa3kDA2Jl6UuVI1xyoHnEHSzT33BMaxePQBN7LXFvBBFPswu1d_gySwTSdyiGJAG866PM4wEmwOR16z1fr32XG8ij8NoCTNS-STfbOuHtVDC4DRr_uWRYYv7rHmATg&dbm_d=AKAmf-BTRTiAW9XBJY7cfk0UjH09PcHxGP8_C8bTyD5WoocIrrOz1HkLfu2rmxjhrFmTon7_uU4RqzkGD0bBhSjbbWF65Uz_yg4bviLs57zv7aWbBQlUCXRqQsvqf8fCu9Xzn7xmTWbdVI8Qpr2P0TrNPlN5QaEnHzcb27a7JR6DKJ6MdVA5EvmSo2qDJQM8xmeNX3NBCxNrSMz4d3B7iUtpPqmBfdL5LGZdrYJ70AkBmW6CLJz2WC7S0W-H2O2fUPBgQJ4MLxgnEkmsPPHtjQNulgdHxSv-VaWrCHLFhkqVD-ktSmtXO2xhb3GRVDQtjp_8oNCFiaWibkj6_uZrVpk-t6SJnxJ43Fe8iBSLDEaNG5wZKJ7nS9YijJIbnx8KYLYjyN8vpL0R8neePR2ln_JaHXZUFRY8nIElSfMs4I288dZNM0rfkAgZwufxVDYXVI9An71SideLuObBXNxdvumDyXpTDv5BbmVw8-8HHT8Jq7w7DtiAetv1jhamfGct0l9XMURdX35zKAMt-7FMUGuwK8s1mRATxxjmnemN119gJMtdoo6TaIWESG88PjkBDTRCWBVnx8QOxz4Y9dWQE1wgmiJbYpAb_nsH18MAs9XS1pz7vHllO81c9cvzdEbKFmEGQ-CfkdAZIxtl6vLHrMNPmxEiECfDE-Yon1ai9vWBT6kp2ZhHWmZc3pK5BjE6lK2wcEaVMbuKf34eH1IWzEEeZ5yV-PEZrp1IejFgf-zuMKx0-z9I1lvU3e0FZB8xcf21kFE-ycf-Ma-RYacYtslA6JenTb6ofNYu4_hjwZlTC85KcfL0sAt7P40exA8E5DriQHZNh0f-TV9bTOUpPyq2MJWqSwsbneEvR5PYklZS5DrpusrjYnMj456xtp6Tg_91ujMswEAxvPmWw4a0jBm_z5qT_Yif9mLa59GLtRHjhd5v_SNoDtGGQNRGbjGDB4F1qIT9QmeE45WcgqMapII9jwNtpkOKXOlsro8XcIsG509ika72L_3nPJaz_NMfDZUqKdo_fnIVGYO7kzZBafVVrbsLFJrAxT5IjD4q46D1lTp6BNMEz_Mf_uH_wLijOfJU070RZXUqndgB92iXRgUprtLGogDM-YAZRgzYamKpSI9FhLQInWBeQzT9z5GPp5bVB_bTWJR-NVdTLERVkl_xNGzyrh3vr94WP70lml0heZ-tFBraRUn8z_nT2OrNCeYQ-ymSVYmaAZQQOnVsJ5jHTKGsCU2zTthwHjAcaXZJojNIfQwvC5nY785sTGMGpGB7o9b7UQNPOvc-dUFPqBELnhxqjNZ8M2Kgs8ZNdfs2qYTtHDM4ymWnIBQ5B1j4VDSy0WGjuXrApdJlareCsMgAxqDiLSw4TQaNs22LvUDfQ_x4J5UMBmBsHvTz0gWtQsLELdDi9R8kRBWjSz9qXY6P2syyPA37-BnV0I87H4lPG0mqkl8HBGvu9fvicvKC9UckQJyFQsfH_XpFhsam8F3Sm1hP_hMMRl1TAJcQTkHtwf5ieCD1P-8MpRLMEYvlbENOgnptfZmhJiku-VHH_Aevxzm0szHWtkSG2ZCh_b_--KYmJKzxPFAz73lHLd-fmDCRJkOAEt1VWG4Q1NAkN8zMeb7GBcgNg58SV_qXWZHDLALieyb8wB51bQ85yetrtn2-ekM9Fm97VgsycNp9mElOt_D-4GKuEuMa2mKVT46XeXRmj5maFGsNNisUcLmB7yFfJnL1Ev4GGHvjLlNJGePL8tcfC_jDL06gCnUqn7kF-qvrcvP3-c_M89L1RXd-gQAwiYyLLSxYSVDgPtMoZl5y4OU38aOnlCsy0-Mj4epxtNv9Gdj9VVqp3a6usCn5zJVT29dqCDevJLWqWjMKCHpKR4OghcGKIRidTsm4SaP0ip5l52BxJArPmXP_4hLntxdJBWbzawamjf0BLXIoHgrtT23HmHIxc3KXXvt-WAvwW-JnEzNLStTgnJmrLQi7qBV3a9mDFhLbkZG0bx9xK5lPB-aDGyf4EXuqR8RjqWGEgytZVhBqwndKLzlf3ZoP7Ev2A3j5KcvTdqcQ608Ihr_WeiEBKoQo7yTLGNN2z5e8lLjdT6hMLhoIR6Jc60cq-ku34Y6gptpSeIdVDARfppfxzgay7NPET1tuvkVjZJHHe_ZY4gZ74THI0d2u202p9Jp7-3N0_gQ5sacNfmUD_0caE_p9tg-3dDdDxVBxEyHmIP1NBle4AGq3HTzZJnS5o-RVLkUJH9tkK5_blp2ZtMGPKGkVFI_JsW0Okzi114oc-IpPQnO5KOzbm-X0es4Gh7geZ2pNTUc1lKfPkdjFCTpYTi3Duyh2ggbRdsbMAlEYq4WupVB-VQF-dM8k_cN0sSQpVZ-uTOaSN_oBwWcaRIYtHw_Si-eXYnOuQCQMNEcgL5BrHVEXgEr2A5WcNLlwi6AwyXWRJ29qZn7mPDeXJ4Zu6wihlTRM0l2FhJvLRyjmaPx4s0ysaYfWhAl2jzE0qZFVkBkD4nMQzlKz8R47NZjlxUN376rWh3Wnj44SmCIF0lT-WbUlR9wp4EznWWtysfosKb5prvXpOM0a3vI5qB7VbLwmTe0lyjQhasTrVJyGwKlyzfC1Wza3YIUQDET-bqFErkNoDLdQjuzY7jhs3Bj4RLVlNohyhbDrplkiBR3eYEpGWpX0OYrSKYXxS4Nq1MyMTuJE6-dGDP6PEEPguurUi5NH9kBrtmOlCZkMGXb7uPPOG0H-xVqHNF3hO8v9o4OSIX0DmwHD7mKFkXnR1CAP1m8mE7MQZAOW-PL8DoK7SEk2N_D6HLSIcN3LyOuuYh32HpAuoBMdvLQGd5DrjoaLYtLsIwVjSW3JjGNUhf6h8Mj9p_N_tF6v9AWieL5mjBoB1UQwuv_yhmG6GjxLx7HUkce2ABGkgLBgrytUMV3Nnd_cY2pPeGLkfX9JqP9fhPBoeLcEIrbCsfyDSPZzqhVVGlnfjYUf7Q&cid=CAASEuRo0tFLUUhoRiyCtVSCyOK0vQ&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Requested by

Host: yifysub.net
URL: https://yifysub.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a73e6608be35571ca6461faa94e95a407633d0493d142b2a26ca86cf72735924

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31632
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame AA23 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/window_focus_fy2019.js

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:50:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 147
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:50:09 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AA23 124 KB
38 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:52:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sun, 13 Feb 2022 14:52:36 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/ Frame AA23 15 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:46:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 391
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:46:05 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame AA23 0
0 14ms
14ms Image
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTGufQuZgzgWLaEMlZJKS56OoAyl7y3xzKbtYsVmEbJ45CnUmX4AOm0Mg4R2MrCkuqGhAcVdJ3SYphegJf3Dd71hmUR2Q
Requested by: Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AA23 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BifK-7NPTqcJ0nSfZUuftPHsxJVbmFARCspw1yfFaGl18Uu4jZFoDQX3wFadovt2t3o0Ynse6dvnbF-kHP9rCJ1y6BvnDaRUh3ao427Yz_Abq3d2I

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame 086A 19 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a7b5f2e7e3fd51102d05b2706291210864e7890361d932311a18048073374ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:45:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 421
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8079
x-xss-protection: 0
server: cafe
etag: 5902764951541284931
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:45:35 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 79DD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESED4U0YZCKq4GWzqbPOPcpUI&google_cver=1

43 B
61 B

16ms
16ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESED4U0YZCKq4GWzqbPOPcpUI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCM7Z4BGM-_jMEBMAE&v=APEucNWWeH3DVNu69EzGAl60usMRsGMBLyVQRRP8fpv9ZgBqPDzixz4XPW95l3rerm94bMQK40YPoK3pyuhkJMriHxy4FhHXcernCFrMAn7OzQq4Gt9XFnnR-atfTucCYr4p2x6KqCweUxJ57aQidB5zPw5lY-mVvdwKAhBRQupKMA-EC33adxc8vuTnIVF74ds1IRMS_aXIsCms7yOItVx_DHeInF22HA
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESED4U0YZCKq4GWzqbPOPcpUI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cm
us-u.openx.net/w/1.0/ Frame 79DD 43 B
75 B 16ms
16ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCM7Z4BGM-_jMEBMAE&v=APEucNWWeH3DVNu69EzGAl60usMRsGMBLyVQRRP8fpv9ZgBqPDzixz4XPW95l3rerm94bMQK40YPoK3pyuhkJMriHxy4FhHXcernCFrMAn7OzQq4Gt9XFnnR-atfTucCYr4p2x6KqCweUxJ57aQidB5zPw5lY-mVvdwKAhBRQupKMA-EC33adxc8vuTnIVF74ds1IRMS_aXIsCms7yOItVx_DHeInF22HA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 79DD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEALYkwKBq4CJLniMqpqzFto&google_cver=1

23 B
172 B

49ms
49ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEALYkwKBq4CJLniMqpqzFto&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCM7Z4BGM-_jMEBMAE&v=APEucNWWeH3DVNu69EzGAl60usMRsGMBLyVQRRP8fpv9ZgBqPDzixz4XPW95l3rerm94bMQK40YPoK3pyuhkJMriHxy4FhHXcernCFrMAn7OzQq4Gt9XFnnR-atfTucCYr4p2x6KqCweUxJ57aQidB5zPw5lY-mVvdwKAhBRQupKMA-EC33adxc8vuTnIVF74ds1IRMS_aXIsCms7yOItVx_DHeInF22HA
Protocol: H2
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sun, 13 Feb 2022 14:52:36 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEALYkwKBq4CJLniMqpqzFto&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 79DD 23 B
172 B 58ms
58ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMPxZBCM7Z4BGM-_jMEBMAE&v=APEucNWWeH3DVNu69EzGAl60usMRsGMBLyVQRRP8fpv9ZgBqPDzixz4XPW95l3rerm94bMQK40YPoK3pyuhkJMriHxy4FhHXcernCFrMAn7OzQq4Gt9XFnnR-atfTucCYr4p2x6KqCweUxJ57aQidB5zPw5lY-mVvdwKAhBRQupKMA-EC33adxc8vuTnIVF74ds1IRMS_aXIsCms7yOItVx_DHeInF22HA
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
cache-control: max-age=0, no-cache, no-store
expires: Sun, 13 Feb 2022 14:52:36 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/ Frame AA23 24 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D8MQFWMiiXup-xt346OiuuwGRpDngXZa3kDA2Jl6UuVI1xyoHnEHSzT33BMaxePQBN7LXFvBBFPswu1d_gySwTSdyiGJAG866PM4wEmwOR16z1fr32XG8ij8NoCTNS-STfbOuHtVDC4DRr_uWRYYv7rHmATg&dbm_d=AKAmf-BTRTiAW9XBJY7cfk0UjH09PcHxGP8_C8bTyD5WoocIrrOz1HkLfu2rmxjhrFmTon7_uU4RqzkGD0bBhSjbbWF65Uz_yg4bviLs57zv7aWbBQlUCXRqQsvqf8fCu9Xzn7xmTWbdVI8Qpr2P0TrNPlN5QaEnHzcb27a7JR6DKJ6MdVA5EvmSo2qDJQM8xmeNX3NBCxNrSMz4d3B7iUtpPqmBfdL5LGZdrYJ70AkBmW6CLJz2WC7S0W-H2O2fUPBgQJ4MLxgnEkmsPPHtjQNulgdHxSv-VaWrCHLFhkqVD-ktSmtXO2xhb3GRVDQtjp_8oNCFiaWibkj6_uZrVpk-t6SJnxJ43Fe8iBSLDEaNG5wZKJ7nS9YijJIbnx8KYLYjyN8vpL0R8neePR2ln_JaHXZUFRY8nIElSfMs4I288dZNM0rfkAgZwufxVDYXVI9An71SideLuObBXNxdvumDyXpTDv5BbmVw8-8HHT8Jq7w7DtiAetv1jhamfGct0l9XMURdX35zKAMt-7FMUGuwK8s1mRATxxjmnemN119gJMtdoo6TaIWESG88PjkBDTRCWBVnx8QOxz4Y9dWQE1wgmiJbYpAb_nsH18MAs9XS1pz7vHllO81c9cvzdEbKFmEGQ-CfkdAZIxtl6vLHrMNPmxEiECfDE-Yon1ai9vWBT6kp2ZhHWmZc3pK5BjE6lK2wcEaVMbuKf34eH1IWzEEeZ5yV-PEZrp1IejFgf-zuMKx0-z9I1lvU3e0FZB8xcf21kFE-ycf-Ma-RYacYtslA6JenTb6ofNYu4_hjwZlTC85KcfL0sAt7P40exA8E5DriQHZNh0f-TV9bTOUpPyq2MJWqSwsbneEvR5PYklZS5DrpusrjYnMj456xtp6Tg_91ujMswEAxvPmWw4a0jBm_z5qT_Yif9mLa59GLtRHjhd5v_SNoDtGGQNRGbjGDB4F1qIT9QmeE45WcgqMapII9jwNtpkOKXOlsro8XcIsG509ika72L_3nPJaz_NMfDZUqKdo_fnIVGYO7kzZBafVVrbsLFJrAxT5IjD4q46D1lTp6BNMEz_Mf_uH_wLijOfJU070RZXUqndgB92iXRgUprtLGogDM-YAZRgzYamKpSI9FhLQInWBeQzT9z5GPp5bVB_bTWJR-NVdTLERVkl_xNGzyrh3vr94WP70lml0heZ-tFBraRUn8z_nT2OrNCeYQ-ymSVYmaAZQQOnVsJ5jHTKGsCU2zTthwHjAcaXZJojNIfQwvC5nY785sTGMGpGB7o9b7UQNPOvc-dUFPqBELnhxqjNZ8M2Kgs8ZNdfs2qYTtHDM4ymWnIBQ5B1j4VDSy0WGjuXrApdJlareCsMgAxqDiLSw4TQaNs22LvUDfQ_x4J5UMBmBsHvTz0gWtQsLELdDi9R8kRBWjSz9qXY6P2syyPA37-BnV0I87H4lPG0mqkl8HBGvu9fvicvKC9UckQJyFQsfH_XpFhsam8F3Sm1hP_hMMRl1TAJcQTkHtwf5ieCD1P-8MpRLMEYvlbENOgnptfZmhJiku-VHH_Aevxzm0szHWtkSG2ZCh_b_--KYmJKzxPFAz73lHLd-fmDCRJkOAEt1VWG4Q1NAkN8zMeb7GBcgNg58SV_qXWZHDLALieyb8wB51bQ85yetrtn2-ekM9Fm97VgsycNp9mElOt_D-4GKuEuMa2mKVT46XeXRmj5maFGsNNisUcLmB7yFfJnL1Ev4GGHvjLlNJGePL8tcfC_jDL06gCnUqn7kF-qvrcvP3-c_M89L1RXd-gQAwiYyLLSxYSVDgPtMoZl5y4OU38aOnlCsy0-Mj4epxtNv9Gdj9VVqp3a6usCn5zJVT29dqCDevJLWqWjMKCHpKR4OghcGKIRidTsm4SaP0ip5l52BxJArPmXP_4hLntxdJBWbzawamjf0BLXIoHgrtT23HmHIxc3KXXvt-WAvwW-JnEzNLStTgnJmrLQi7qBV3a9mDFhLbkZG0bx9xK5lPB-aDGyf4EXuqR8RjqWGEgytZVhBqwndKLzlf3ZoP7Ev2A3j5KcvTdqcQ608Ihr_WeiEBKoQo7yTLGNN2z5e8lLjdT6hMLhoIR6Jc60cq-ku34Y6gptpSeIdVDARfppfxzgay7NPET1tuvkVjZJHHe_ZY4gZ74THI0d2u202p9Jp7-3N0_gQ5sacNfmUD_0caE_p9tg-3dDdDxVBxEyHmIP1NBle4AGq3HTzZJnS5o-RVLkUJH9tkK5_blp2ZtMGPKGkVFI_JsW0Okzi114oc-IpPQnO5KOzbm-X0es4Gh7geZ2pNTUc1lKfPkdjFCTpYTi3Duyh2ggbRdsbMAlEYq4WupVB-VQF-dM8k_cN0sSQpVZ-uTOaSN_oBwWcaRIYtHw_Si-eXYnOuQCQMNEcgL5BrHVEXgEr2A5WcNLlwi6AwyXWRJ29qZn7mPDeXJ4Zu6wihlTRM0l2FhJvLRyjmaPx4s0ysaYfWhAl2jzE0qZFVkBkD4nMQzlKz8R47NZjlxUN376rWh3Wnj44SmCIF0lT-WbUlR9wp4EznWWtysfosKb5prvXpOM0a3vI5qB7VbLwmTe0lyjQhasTrVJyGwKlyzfC1Wza3YIUQDET-bqFErkNoDLdQjuzY7jhs3Bj4RLVlNohyhbDrplkiBR3eYEpGWpX0OYrSKYXxS4Nq1MyMTuJE6-dGDP6PEEPguurUi5NH9kBrtmOlCZkMGXb7uPPOG0H-xVqHNF3hO8v9o4OSIX0DmwHD7mKFkXnR1CAP1m8mE7MQZAOW-PL8DoK7SEk2N_D6HLSIcN3LyOuuYh32HpAuoBMdvLQGd5DrjoaLYtLsIwVjSW3JjGNUhf6h8Mj9p_N_tF6v9AWieL5mjBoB1UQwuv_yhmG6GjxLx7HUkce2ABGkgLBgrytUMV3Nnd_cY2pPeGLkfX9JqP9fhPBoeLcEIrbCsfyDSPZzqhVVGlnfjYUf7Q&cid=CAASEuRo0tFLUUhoRiyCtVSCyOK0vQ&rfl=2%2Chttps%253A%252F%252Fyifysub.net%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 74
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/ Frame AA23 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220209/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sun, 13 Feb 2022 14:51:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 51
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 27 Feb 2022 14:51:45 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AA23 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 12 Feb 2022 23:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 53560
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 Feb 2023 23:59:56 GMT

GET
H3 200 12807858296109198889
s0.2mdn.net/simgad/ Frame AA23 43 KB
44 KB 7ms
7ms Image
image/gif 2a00:1450:4001:800::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/12807858296109198889

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

53eb464740ce9143d787568298741516e65bc4bb815dc630e855dfdde51a58bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 05:36:41 GMT
x-content-type-options: nosniff
age: 292555
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44510
x-xss-protection: 0
last-modified: Tue, 01 Feb 2022 11:52:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 10 Feb 2023 05:36:41 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F947 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Sun, 13 Feb 2022 05:53:44 GMT
expires: Mon, 14 Feb 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 32332
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 99FE 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sun, 13 Feb 2022 01:16:16 GMT
expires: Mon, 13 Feb 2023 01:16:16 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 48980
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame F947 70 B
265 B 209ms
29ms Image
image/gif 35.71.131.137

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESECjKqSpFkTvGX0aqcgMZj3o&google_cver=1&google_push=AYg5qPIF6q7ZbLuoq-2-VxFpOPZaK0YbygR7-O8pgzG0-pcPDxYg-jbq4DWlgNMSzFQQ2JTlpDkg17oEpw59ZtDqYgzFvl52p-Y
Requested by: Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:37 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame F947 0
191 B 201ms
22ms Image
text/plain 66.155.71.149

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEM0tWI1GyGQWJZ_jFo5T6vc&google_cver=1&google_push=AYg5qPJNpaN6bwjquZrwWyxV4-hymCVW1nr1JrD7Ua3lAYYukiDG5Wp8Y_SNIFivTcPp8EOTx0ELNVisJyDmqTJsCoGJjZXNaQo
Requested by: Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.149 -, , ASN (),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:36 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F947
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEIdh-Ig5ZRJW4ToX7jJyvlA&google_cver=1&google_push=AYg5qPJ0_TvCDKq8ouI4z6nEebjSbEEaEsRpuxMr2Ay6Q4-PGZEgXg5lx3lbnJ3PnhYTc952foVMh33ErZ2-hu...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA2NDIwNzQwNDk1NzAzODc0Ng%3D%3D&google_push=AYg5qPJ0_TvCDKq8ouI4z6nEebjSbEEaEsRpuxMr2Ay6Q4-PGZEgXg5lx3lbnJ3PnhYTc952foVMh33ErZ2-huvdnE...

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA2NDIwNzQwNDk1NzAzODc0Ng%3D%3D&google_push=AYg5qPJ0_TvCDKq8ouI4z6nEebjSbEEaEsRpuxMr2Ay6Q4-PGZEgXg5lx3lbnJ3PnhYTc952foVMh33ErZ2-huvdnEzcfwquX38

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzA2NDIwNzQwNDk1NzAzODc0Ng%3D%3D&google_push=AYg5qPJ0_TvCDKq8ouI4z6nEebjSbEEaEsRpuxMr2Ay6Q4-PGZEgXg5lx3lbnJ3PnhYTc952foVMh33ErZ2-huvdnEzcfwquX38
Date: Sun, 13 Feb 2022 14:52:37 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F947
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFEiSaM4Ndx0l4wmtRfCuZI&google_cver=1&google_push=AYg5qPKcN2ShLpqRFKjJUg_IiZrgXb9DVlZJtVpJaYvlHD2_AmttkFG4D5nvzugpp4lXrS3CRGrwmXcccFcxv9z_Au7l...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEFEiSaM4Ndx0l4wmtRfCuZI&google_cver=1&google_push=AYg5qPKcN2ShLpqRFKjJUg_IiZrgXb9DVlZJtVpJaYvlHD2_AmttkFG4D5nvzugpp4lXrS3CRGrwmXcccFcxv9...
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=89152420-4031-4e3a-b2ab-3359ba4e2bcf
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=89152420-4031-4e3a-b2ab-3359ba4e2bcf
https://x.bidswitch.net/sync?dsp_id=4&user_id=f9a034b5-4351-45e9-b33b-99b959c389c9&ssp=google&expires=30&user_group=5&bsw_param=89152420-4031-4e3a-b2ab-3359ba4e2bcf
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKcN2ShLpqRFKjJUg_IiZrgXb9DVlZJtVpJaYvlHD2_AmttkFG4D5nvzugpp4lXrS3CRGrwmXcccFcxv9z_Au7ln2BnHZQ&google_hm=iRUkIEAxTjqyqzNZuk4rzw==

170 B
188 B

40ms
39ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKcN2ShLpqRFKjJUg_IiZrgXb9DVlZJtVpJaYvlHD2_AmttkFG4D5nvzugpp4lXrS3CRGrwmXcccFcxv9z_Au7ln2BnHZQ&google_hm=iRUkIEAxTjqyqzNZuk4rzw==

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPKcN2ShLpqRFKjJUg_IiZrgXb9DVlZJtVpJaYvlHD2_AmttkFG4D5nvzugpp4lXrS3CRGrwmXcccFcxv9z_Au7ln2BnHZQ&google_hm=iRUkIEAxTjqyqzNZuk4rzw==
Date: Sun, 13 Feb 2022 14:52:37 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F947
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJpFO9TrvZRWojbesFhrkT8&google_cver=1&google_push=AYg5qPLAyNqQlRKSepv2t9oDKOFQX-LKK6uBXrGgH6HJI4m-cP-b2XkME_cUbYZnLWmDG9hFlexlF4roN3qhguE8X0jUuqk...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPLAyNqQlRKSepv2t9oDKOFQX-LKK6uBXrGgH6HJI4m-cP-b2XkME_cUbYZnLWmDG9hFlexlF4roN3qhguE8X0jUuqkv3Uc&google_hm=NTAzNzY0NTIxODA4OTAzMzA%3D

170 B
188 B

42ms
41ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPLAyNqQlRKSepv2t9oDKOFQX-LKK6uBXrGgH6HJI4m-cP-b2XkME_cUbYZnLWmDG9hFlexlF4roN3qhguE8X0jUuqkv3Uc&google_hm=NTAzNzY0NTIxODA4OTAzMzA%3D

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 13 Feb 2022 14:52:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 13 Feb 2022 14:52:37 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPLAyNqQlRKSepv2t9oDKOFQX-LKK6uBXrGgH6HJI4m-cP-b2XkME_cUbYZnLWmDG9hFlexlF4roN3qhguE8X0jUuqkv3Uc&google_hm=NTAzNzY0NTIxODA4OTAzMzA%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F947 0
12 B 21ms
20ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13InMhZrTtXX5K2cGxJe9WXCAsJHbaYGWjqIziVeTHJAarkSv7Yw_9g0n1I

Requested by

Host: 35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com
URL: https://35f9818e060884d64c755326b44ceacd.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS