forex.alghtas.xyz Open in urlscan Pro
162.0.209.219 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://forex.alghtas.xyz/
Effective URL:
https://forex.alghtas.xyz/
Submission: On November 18 via api (November 18th 2023, 12:46:33 am UTC) from US — Scanned from DE

Summary HTTP 383 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 30 IPs in 8 countries across 26 domains to perform 383 HTTP transactions. The main IP is 162.0.209.219, located in United States and belongs to NAMECHEAP-NET, US. The main domain is forex.alghtas.xyz.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on October 3rd 2023. Valid for: a year.

This is the only time forex.alghtas.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 36	162.0.209.219 162.0.209.219	22612 (NAMECHEAP...) (NAMECHEAP-NET)
15	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:82b::2001	15169 (GOOGLE) (GOOGLE)
55	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
59	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:81c::2003	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
72	2a00:1450:400... 2a00:1450:4001:813::2006	15169 (GOOGLE) (GOOGLE)
14 39	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
4 10	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5 8	37.252.171.52 37.252.171.52	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2a02:26f0:350... 2a02:26f0:3500:d::1732:83c8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	142.250.186.70 142.250.186.70	15169 (GOOGLE) (GOOGLE)
1 1	2600:9000:223... 2600:9000:223d:c400:c:bbc8:bbc0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:264... 2600:9000:2644:8c00:1f:f009:8540:93a1	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
1	130.211.44.5 130.211.44.5	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 7	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
1 2	46.228.164.11 46.228.164.11	56396 (AMOBEE) (AMOBEE)
2 2	3.125.12.15 3.125.12.15	16509 (AMAZON-02) (AMAZON-02)
1	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
1	2600:9000:211... 2600:9000:211e:3a00:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1 4	2.16.97.41 2.16.97.41	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	35.214.192.64 35.214.192.64	15169 (GOOGLE) (GOOGLE)
2	35.244.159.8 35.244.159.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.71.149.231 3.71.149.231	16509 (AMAZON-02) (AMAZON-02)
2	185.86.139.94 185.86.139.94	201081 (SMARTADSE...) (SMARTADSERVER)
3 7	2606:4700::68... 2606:4700::6812:18ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4 4	34.91.62.186 34.91.62.186	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
4 4	2a05:d018:d29... 2a05:d018:d29:3601:af70:5903:a54a:226c	16509 (AMAZON-02) (AMAZON-02)
7 7	213.155.156.185 213.155.156.185	1299 (TWELVE99 ...) (TWELVE99 Arelion)
1	141.101.90.96 141.101.90.96	13335 (CLOUDFLAR...) (CLOUDFLARENET)
383	30

36 162.0.209.219 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: business96-2.web-hosting.com

forex.alghtas.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

55 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

59 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:81c::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

72 2a00:1450:4001:813::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

39 142.250.184.226 (United States) 14 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.18.36.155 (None, ) 4 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 37.252.171.52 (Frankfurt am Main, Germany) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3500:d::1732:83c8 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

cdn.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 142.250.186.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223d:c400:c:bbc8:bbc0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

pixel.de-config.sensic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2644:8c00:1f:f009:8540:93a1 (United States)

ASN16509 (AMAZON-02, US)

1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 130.211.44.5 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 5.44.211.130.bc.googleusercontent.com

tps.doubleverify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.228.164.11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.125.12.15 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-125-12-15.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:3a00:1b:5138:8a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.16.97.41 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-16-97-41.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.214.192.64 (Groningen, Netherlands) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 64.192.214.35.bc.googleusercontent.com

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.71.149.231 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.86.139.94 (France)

ASN201081 (SMARTADSERVER, FR)

rtb-csync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700::6812:18ad (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.91.62.186 (Groningen, Netherlands) 4 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 186.62.91.34.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a05:d018:d29:3601:af70:5903:a54a:226c (Dublin, Ireland) 4 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 213.155.156.185 (Sweden) 7 redirects

ASN1299 (TWELVE99 Arelion, fka Telia Carrier, SE)

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.101.90.96 (United States)

ASN13335 (CLOUDFLARENET, US)

portal.o2online.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
123	googlesyndication.com 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 149 pagead2.googlesyndication.com — Cisco Umbrella Rank: 97 ade.googlesyndication.com Failed	916 KB
75	doubleclick.net 14 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 245 ad.doubleclick.net — Cisco Umbrella Rank: 154 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 439	597 KB
72	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 300	851 KB
36	alghtas.xyz 1 redirects forex.alghtas.xyz	647 KB
15	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 406	310 KB
11	gstatic.com www.gstatic.com fonts.gstatic.com	199 KB
10	casalemedia.com 4 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 625	7 KB
8	adnxs.com 5 redirects ib.adnxs.com — Cisco Umbrella Rank: 246 secure.adnxs.com — Cisco Umbrella Rank: 495	6 KB
8	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 212	509 KB
7	de17a.com 7 redirects d5p.de17a.com — Cisco Umbrella Rank: 4905	2 KB
7	tribalfusion.com 3 redirects a.tribalfusion.com — Cisco Umbrella Rank: 860 s.tribalfusion.com — Cisco Umbrella Rank: 2311	4 KB
7	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	709 B
7	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 31	6 KB
5	yahoo.com 4 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 327 pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 492	3 KB
4	simpli.fi 4 redirects um.simpli.fi — Cisco Umbrella Rank: 795	3 KB
4	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1403	777 B
3	openx.net rtb.openx.net — Cisco Umbrella Rank: 695 us-u.openx.net — Cisco Umbrella Rank: 522	654 B
3	doubleverify.com cdn.doubleverify.com — Cisco Umbrella Rank: 496 tps.doubleverify.com — Cisco Umbrella Rank: 515 tpsc-ew1.doubleverify.com Failed	105 KB
2	smartadserver.com rtb-csync.smartadserver.com — Cisco Umbrella Rank: 733	227 B
2	w55c.net 2 redirects pm.w55c.net — Cisco Umbrella Rank: 912	2 KB
2	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 851 r.turn.com — Cisco Umbrella Rank: 4121	869 B
2	sensic.net 1 redirects pixel.de-config.sensic.net — Cisco Umbrella Rank: 60499 1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net	775 B
1	o2online.de portal.o2online.de — Cisco Umbrella Rank: 146086	608 B
1	loopme.me 1 redirects csync.loopme.me — Cisco Umbrella Rank: 940	417 B
1	smaato.net s.ad.smaato.net — Cisco Umbrella Rank: 716	237 B
0	spotxchange.com Failed sync.search.spotxchange.com Failed
383	26

	Domain	Requested by
72	s0.2mdn.net	forex.alghtas.xyz s0.2mdn.net 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
59	pagead2.googlesyndication.com	forex.alghtas.xyz 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com tpc.googlesyndication.com www.googletagservices.com securepubads.g.doubleclick.net pagead2.googlesyndication.com s0.2mdn.net googleads.g.doubleclick.net
55	tpc.googlesyndication.com	forex.alghtas.xyz 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com tpc.googlesyndication.com cdn.ampproject.org securepubads.g.doubleclick.net s0.2mdn.net
37	cm.g.doubleclick.net	14 redirects googleads.g.doubleclick.net 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
36	forex.alghtas.xyz	1 redirects forex.alghtas.xyz
15	cdn.ampproject.org	securepubads.g.doubleclick.net
15	securepubads.g.doubleclick.net	forex.alghtas.xyz securepubads.g.doubleclick.net
12	ad.doubleclick.net	forex.alghtas.xyz
10	dsum-sec.casalemedia.com	4 redirects googleads.g.doubleclick.net
9	googleads.g.doubleclick.net	599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com forex.alghtas.xyz pagead2.googlesyndication.com
9	599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
8	fonts.gstatic.com	fonts.googleapis.com
8	www.googletagservices.com	forex.alghtas.xyz 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
7	d5p.de17a.com	7 redirects
7	www.google.com	1 redirects forex.alghtas.xyz 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com tpc.googlesyndication.com
7	ib.adnxs.com	4 redirects googleads.g.doubleclick.net
7	fonts.googleapis.com	forex.alghtas.xyz 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com securepubads.g.doubleclick.net s0.2mdn.net
4	pr-bh.ybp.yahoo.com	4 redirects
4	um.simpli.fi	4 redirects
4	a.tribalfusion.com	3 redirects 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
4	sync.teads.tv	1 redirects 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com googleads.g.doubleclick.net
3	s.tribalfusion.com	599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
3	www.gstatic.com	forex.alghtas.xyz 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
2	googleads4.g.doubleclick.net	forex.alghtas.xyz
2	rtb-csync.smartadserver.com	googleads.g.doubleclick.net
2	us-u.openx.net	googleads.g.doubleclick.net
2	pm.w55c.net	2 redirects
2	cdn.doubleverify.com	s0.2mdn.net forex.alghtas.xyz
1	portal.o2online.de
1	ups.analytics.yahoo.com	googleads.g.doubleclick.net
1	csync.loopme.me	1 redirects
1	secure.adnxs.com	1 redirects
1	s.ad.smaato.net	599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
1	rtb.openx.net	599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
1	r.turn.com
1	ad.turn.com	1 redirects
1	tps.doubleverify.com	cdn.doubleverify.com
1	1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net	599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
1	pixel.de-config.sensic.net	1 redirects
0	sync.search.spotxchange.com Failed	googleads.g.doubleclick.net
0	tpsc-ew1.doubleverify.com Failed	cdn.doubleverify.com
0	ade.googlesyndication.com Failed	securepubads.g.doubleclick.net
383	42

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
instagram.com
youtube.com
twitter.com
youssefsayed.com
facebook.com

Subject Issuer	Validity	Valid
forex.alghtas.xyz Sectigo RSA Domain Validation Secure Server CA	`2023-10-03` - `2024-10-03`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.doubleverify.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-07` - `2024-05-07`	a year	crt.sh
misc-sni.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.tps.doubleverify.com Go Daddy Secure Certificate Authority - G2	`2023-09-29` - `2024-09-28`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2023-08-18` - `2024-08-18`	a year	crt.sh
s.ad.smaato.net Amazon RSA 2048 M03	`2023-09-04` - `2024-10-02`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
teads.tv R3	`2023-11-03` - `2024-02-01`	3 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-08-03` - `2024-01-24`	6 months	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh
portal.o2online.de E1	`2023-10-01` - `2023-12-30`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-07` - `2024-05-06`	a year	crt.sh

This page contains 45 frames:

Primary Page: https://forex.alghtas.xyz/
Frame ID: FA1669F9ABB131772D8D539F425D23D6
Requests: 57 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 61A6E5CDA405DBB7CFCAF4AA000BA2A2
Requests: 1 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 89E1C837C546EABC62484C623FAF5C5C
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500
Frame ID: E01176AC058D269EBC9EDA9133877F1E
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/unVwOGQH9SsIcJBr4Xp3HcCvUJyc_uBy8Ir4YHk_V1Y.js
Frame ID: E1ED67B3183C8AB78E726184A0E11E09
Requests: 1 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 739901356DDEE069D36BE50073CA2CF8
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhjasIP4ATAB&v=APEucNW3vrIIvlrOjhHhhjSoSFjOfd72GEkEhlaZyudJbu5ecpTSKqWLb-JH78QXQg9SaRSWyv1gRVBT0LzNEfsNdbsjMf9Grj6KebFLoSZ9wAiAMB2Rq2Wll9-4AUO17FtEQCH1e2Ltql4cHFGUYLQTaTMvjUGfV4Xqfu8JNF9ccaEVcag0eNM
Frame ID: B69DF32591959FF98449F317D52D50B5
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: D00AFF55595F9280F9FAC925301E108A
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250
Frame ID: 48260B23FF1F2DE073DD9CEE2BF00DB0
Requests: 12 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements4946.js
Frame ID: AC02B6B27F8B1FD710ECCAB282D3F226
Requests: 9 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs
Frame ID: FA047F60DE9AA127E0AD2E99204FE9D0
Requests: 17 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 1609D59D819B3B1FBAE4FA4E8EF844B9
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCZw2EY2r2g5QEwAQ&v=APEucNXBhywvRvA_kbIsMfcM_L4pM6UKmGbScW8W6O3bclmBZRNsOjJziAv6wud1gSX5vVQmEFNl1va8uslXBLDb0qze9TwyXDicdaADatjeqzYlkXMxEw91UXXB-eI04hAvzuutcQiT9bsAXH7mA1B6vFsVRyfZSzoxwbuKdvWk7dLwKG_6HWs
Frame ID: D50C6535188F4802FF2080D9F9221109
Requests: 5 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: DB9DD4AAD35B5898D7D8EA2D3322E6AE
Requests: 15 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
Frame ID: BFB293F6349EA92305E265E0668196D7
Requests: 11 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 4C4A3B23F131B3DE0BD5DF59E1C4871C
Requests: 3 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs
Frame ID: 26267B5A937FAB99F49AD9B8F3EB89CC
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIvrnPEBMAE&v=APEucNU28BtqJSc0kjiIgJzgCvt8k3LxXFUnIyMxb59MlI3S9xGP7TtYia55SV9UV2ClJKwBi5DOZ9GV8dv44mHPqjv-scG_IrO5xpQ9i4qIx5WzB-R8G3sCN12uUhK5vnmBk-CQog7KsIGqj1Wm9IO42BfxlOECAEneq0aATmi4ePrhaVaG-5g
Frame ID: C3281102F37E17EB9ECFAF09193A9385
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 1F13B16147F39D41E33171127B44AFE0
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
Frame ID: 99202B0E7AFAED7B487C12268D2512C6
Requests: 11 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 5B497D5F2B329CF7C1CD8E2FF08597AE
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 0DAC46609329AB34E078BF058F9655DC
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: E481E7566AB6FEDC044ABE3E0D20BD5C
Requests: 2 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 15149B722E700FE853AD450C74A692A4
Requests: 14 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: AA6B289EC1A21C03444973F5C4F30F09
Requests: 14 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 24AB0AFEB6E66A4A8CD5E831691FFFAE
Requests: 13 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs
Frame ID: 8E281CEA610B0A7F78CE50C516CCF3DD
Requests: 16 HTTP requests in this frame

Frame: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: BF466B7CB3DD1560C69CB6B99432B5E7
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNUcuCFdafwwv2k7p7ylAf5Z-oMDDHdrwQEjiRHJqZcHU6uQYk6c0yKClT9oc36Mh_KruX5h0TE8tEqILsle361mAz1lvbn8ZOjndqfwCKoeY1twtG-hGV90CtbbSeZIzQJbdsT0ykTP8n3wBg6jR5vwgTlqxw1yhvjaRmvW3LbjSKjQO_g
Frame ID: 1E3901838C658E926E070D5118DE97D7
Requests: 5 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 92BF5E0CC3326666B6C7BE5AD6E939F2
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNVPYTB9OqmzMuD4aMhoJ9Py3DqAmj4aldw_bXZjk70COQNTRMtdsiXNWPs7bLEckUNcBfc50fT70WQ5hB9OOFOJqm7UisTHiukIIUg1_5yi_wVJxEnnXDd6M70XzjI5iUzhrxnQxoNzhohwc9XSZwm8e6XmaI2MtbSsOMVIr87fgXNxSB0
Frame ID: 6149AB2372EE2EA248AC6401E5A9B563
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 7B2832BC2C01539ECCDB533C1E513DC6
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARinvLb3ATAB&v=APEucNVe3akyYhls4iZIl5_moIND5B0TN6PuqVMamwz5_cvNubPGFMhIsiXX9fJPI1eiW-QiiobvDf51nFA8SJxZnLpHzXpui1piasps7waoSomFwXc59bkFvkVUmfitDVjXaZymF8N1QAHXnxw8zEX1-IRPKZ05OcoGFI8V4lhu8gnMPb2Tqzc
Frame ID: 3C4C16DBC66F33B843FAEEA0FFAEDDF0
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C3E30A60994665DEADE9E68A84B0A7FD
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhi9z5v-ATAB&v=APEucNU7N7Np-YzHRcDJPFdoZipIeoKl3SKZjgwCC2CAYNZPSXsn_gBneBIV0H5bjE2u4JbbcEdcftfdI1MlslJGgAmZZijn0Eq71sFDNvF0J8UV2L_2AabFo4-IHQaX8v8ITYrded_99tqsdlQcPZv9rupvUWkZjADkvdlOr2yVO4lYJuTM5tY
Frame ID: DDF0D4177591E54B04A64934332C74B5
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
Frame ID: EB3845F7B799C633FC9AAA04EAAED5BD
Requests: 11 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
Frame ID: AD15A38B7E6A7ECE54B3E144A4502707
Requests: 11 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
Frame ID: 1D829F6DBA6584E1223D132E94C73008
Requests: 13 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: BAC38126D2648BAF367DD85572FDAB0A
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 5A0B92564003D0619AAE31308F24EF73
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 88C6D98C7C13DA12292AB69CAC926093
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 58DF64CFF3BE066BCF4FE89E5EF2F5EC
Requests: 6 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/6993610142221704340/index.html?ev=01_250
Frame ID: D92F028D170DB8BA720A07D9ACA45271
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js
Frame ID: 170FDC90B5A1A52F5D28D9992863A7E4
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: C3CACB20CABEB1B09F597B47D69457A7
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Forex Alghtas

Page URL History Show full URLs

http://forex.alghtas.xyz/ HTTP 301
https://forex.alghtas.xyz/ Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Revslider (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/revslider/[/\w-]+/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

383
Requests

86 %
HTTPS

51 %
IPv6

26
Domains

42
Subdomains

30
IPs

8
Countries

4151 kB
Transfer

11715 kB
Size

19
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/BetterSTU
Title: Likes

Search URL Search Domain Scan URL

URL: https://instagram.com/betterstudio
Title: Followers

Search URL Search Domain Scan URL

URL: https://youtube.com/channel/UCrNkHRTRk33C9hzYij4B5ng
Title: Subscribers

Search URL Search Domain Scan URL

URL: https://twitter.com/BetterSTU
Title: Followers

Search URL Search Domain Scan URL

URL: http://instagram.com/youssefsayeddd_
Title: @youssefsayeddd_

Search URL Search Domain Scan URL

URL: https://youssefsayed.com/
Title: Youssef Sayed

Search URL Search Domain Scan URL

URL: https://facebook.com/yousseeffsayed
Title: Youssef Sayed

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://forex.alghtas.xyz/ HTTP 301
https://forex.alghtas.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 61

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1

Request Chain 62

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVgJYJJiT797tUzxZASq5gAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1

Request Chain 63

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEF2elGGabjdQhLrsdW2gu8I&google_cver=1

Request Chain 64

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

Request Chain 68

https://pixel.de-config.sensic.net/tp?ty=IM&optin=false&m=campaign_116_de&c=11600102&pr=1732803402&gdpr=&gdpr_consent= HTTP 302
https://1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net/tp.gif?m=campaign_116_de&r=pixel.de-config.sensic.net&p=de1&instanceid=1700268384848AD999FBF64E5AE9E2AA136F725820B903AC08B978B3

Request Chain 112

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

Request Chain 113

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVgJYJJiT797tUzxZASq5gAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

Request Chain 114

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1

Request Chain 115

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

Request Chain 157

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 158

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

Request Chain 159

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVgJYJJiT797tUzxZASq5gAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

Request Chain 160

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1

Request Chain 161

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

Request Chain 163

https://ad.turn.com/r/cs?pid=3&google_gid=CAESECw6DTn4_rDE1QU7GSB6NLA&google_cver=1&google_push=AXcoOmRKqWe-ZyoWISvXzTr5VP9S3hbQSmhPbA8ysGmEwbrzrOJqne_xE6_g0ygOqzapYE7VUWZV_Xi3F9d3YEPTIdvOvAxAu-6Vcg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjMzODU2NjgzNjk0OTA2OTA3OA==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECw6DTn4_rDE1QU7GSB6NLA&google_cver=1

Request Chain 164

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&google_cver=1&google_push=AXcoOmR8-tJCuhaepiy6nVs_cftdOPhTUSwW88Pxr7JZqjE5sNFhQLlAJnEGHFFu50R3pslt51H85vXoukyr62vix08vm75f33YZhQ HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&google_cver=1&google_push=AXcoOmR8-tJCuhaepiy6nVs_cftdOPhTUSwW88Pxr7JZqjE5sNFhQLlAJnEGHFFu50R3pslt51H85vXoukyr62vix08vm75f33YZhQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aVh1aVBpWWQxUjQ5dEU1&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&google_cver=1&google_push=AXcoOmR8-tJCuhaepiy6nVs_cftdOPhTUSwW88Pxr7JZqjE5sNFhQLlAJnEGHFFu50R3pslt51H85vXoukyr62vix08vm75f33YZhQ

Request Chain 167

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEJWq069w0xRjDNYSECbKdK8&google_cver=1&google_push=AXcoOmSF0obw6m4VNHwLB1V68h0_k6j8fS3yc2guIV7D-EriSXSt23CbCF1mISM7s2mVYjXLqkutqhT0KyvKSfKXi5X6G-vw7jlGgEI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmSF0obw6m4VNHwLB1V68h0_k6j8fS3yc2guIV7D-EriSXSt23CbCF1mISM7s2mVYjXLqkutqhT0KyvKSfKXi5X6G-vw7jlGgEI HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 168

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEEk2GGCXfEdF6R-VQSRKF8I&google_cver=1&google_push=AXcoOmSIjaOaC14cqKLEwAk47ODvvpppoLtEyoWGjx3HUEf4Ip6KCRObwU74IJn0pTSNRxk3wCg4fHueJvz1QVG8MovHZcCKjpnHSjo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D&google_gid=CAESEEk2GGCXfEdF6R-VQSRKF8I&google_cver=1&google_push=AXcoOmSIjaOaC14cqKLEwAk47ODvvpppoLtEyoWGjx3HUEf4Ip6KCRObwU74IJn0pTSNRxk3wCg4fHueJvz1QVG8MovHZcCKjpnHSjo

Request Chain 169

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_gid=CAESEOp3WrUq2qK6LbJpk4OLNhU&google_cver=1&google_push=AXcoOmRTiZG16ZNNmDIJ9VwizD9LAhWHp6h1uFvXM3MgtPflsFBaQtM5qPWtOfkmb1_jytnqej4B-owDPPm66K0262IfKs06EiNdX0A HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=4bc4f3dd-8841-43c3-9be6-eea352f97f39&google_cver=1&google_gid=CAESEOp3WrUq2qK6LbJpk4OLNhU&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmRTiZG16ZNNmDIJ9VwizD9LAhWHp6h1uFvXM3MgtPflsFBaQtM5qPWtOfkmb1_jytnqej4B-owDPPm66K0262IfKs06EiNdX0A&gdpr=${GDPR}

Request Chain 286

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENgK0rs4elZg3Ctnz8k6ISE&google_cver=1

Request Chain 288

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEEzjs3G-vu1CuIsZNaQRnEY&google_cver=1

Request Chain 290

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESED8upFD0e76Fco_VS713bZs&google_cver=1

Request Chain 293

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm HTTP 302
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESECwVTMSkInoeyrJrM0G9vcg&google_cver=1

Request Chain 299

https://a.tribalfusion.com/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 300

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmRC2b9sEv-FDlb8On_ic8nlRCVkXOQTeEiJ4ByzARO-qgr9Hhc2eJ2Pqpz7beWWW5QrRK67iOjSJpwT1hqQ5XRN8XnwmV-m HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3B5F0E3AAA0B4547900FF69E695F74EC&google_push=AXcoOmRC2b9sEv-FDlb8On_ic8nlRCVkXOQTeEiJ4ByzARO-qgr9Hhc2eJ2Pqpz7beWWW5QrRK67iOjSJpwT1hqQ5XRN8XnwmV-m

Request Chain 301

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmQl5HcTWwMdLCvVWwL8MZ5BPSI4WTf0NoBMPOROR2-7trjIh_9I3sXomvjy_8bjHPeBkpsHuwwregWDRuO-FE0mE3L5FsRN HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQl5HcTWwMdLCvVWwL8MZ5BPSI4WTf0NoBMPOROR2-7trjIh_9I3sXomvjy_8bjHPeBkpsHuwwregWDRuO-FE0mE3L5FsRN&google_hm=eS0wUnZFY2ZWRTJwRVA4bXNzOGxvNHdYUElZODBacTFEM35B

Request Chain 302

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZvsMcBN5 HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZvsMcBN5 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZvsMcBN5

Request Chain 304

https://a.tribalfusion.com/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 305

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmR5N5zuR3wGncKpJ87CImVz_rMwFU4SgabM9DlNmj8f30qurAv5oSdVGf-i_riEFhHsNbZcRnsJlvKhg45IQH29KBbYa2QN9w HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=5B280CF3040248729EC43E93BC6C189A&google_push=AXcoOmR5N5zuR3wGncKpJ87CImVz_rMwFU4SgabM9DlNmj8f30qurAv5oSdVGf-i_riEFhHsNbZcRnsJlvKhg45IQH29KBbYa2QN9w

Request Chain 306

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmTdsw5lynY7utFiTwM01o5XxVpM5aV5UGv5dS32R9dvHpmVOlGvMgBQ5mKz8Cx7xU5hGPUQMGWej7NZZFhBMQoEnKhj3uAGBw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTdsw5lynY7utFiTwM01o5XxVpM5aV5UGv5dS32R9dvHpmVOlGvMgBQ5mKz8Cx7xU5hGPUQMGWej7NZZFhBMQoEnKhj3uAGBw&google_hm=eS1aNFl4UXNsRTJwRjVFdlBXeFdfZjRXTGdJZTlMTFJqQn5B

Request Chain 307

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4RNEo7dy3g HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4RNEo7dy3g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4RNEo7dy3g

Request Chain 311

https://a.tribalfusion.com/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 312

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmRRiKKv32FAvMTThDpmyyfiCdASrovEt8yefbhdeLUvilZhT1fAaAqCot8JxnUcjLYBuiZIUox0bFI3K2NgJ2KtTY7veX4 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmRRiKKv32FAvMTThDpmyyfiCdASrovEt8yefbhdeLUvilZhT1fAaAqCot8JxnUcjLYBuiZIUox0bFI3K2NgJ2KtTY7veX4

Request Chain 313

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmQyDLyI6V2NQmGHDpxZdcTohz_iXm-fUBrqApn7VVJERpDTIIQNsHVpUmbIHwGtAMePMl68tadDei45NMGxhtSb5j5H_tri HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQyDLyI6V2NQmGHDpxZdcTohz_iXm-fUBrqApn7VVJERpDTIIQNsHVpUmbIHwGtAMePMl68tadDei45NMGxhtSb5j5H_tri&google_hm=eS01NTRSNlhGRTJwR01sUkUzZEZwbzU2WVlSZGNBdTBZcH5B

Request Chain 314

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmFb08G3HP HTTP 302
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmFb08G3HP HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmFb08G3HP

Request Chain 376

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmQ2a1wcWAxERaLqdolKDCT1kI38WDc4n8vSP6uF5xttOgjzf-OfmMoBNzXKlVpN5R86wY_wC41Pjk35JUdOBqEW7ceQmSYM HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmQ2a1wcWAxERaLqdolKDCT1kI38WDc4n8vSP6uF5xttOgjzf-OfmMoBNzXKlVpN5R86wY_wC41Pjk35JUdOBqEW7ceQmSYM

Request Chain 377

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmQ3wW_LJzaotUWfXYsb8t_XgDVu5VsLqhB5nHLTn7EnS4ZFfFdkjP2Enkjtvg4nhW3hzR3dBEYcKbF96ZPOqJhcwuwBd9Qq HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ3wW_LJzaotUWfXYsb8t_XgDVu5VsLqhB5nHLTn7EnS4ZFfFdkjP2Enkjtvg4nhW3hzR3dBEYcKbF96ZPOqJhcwuwBd9Qq&google_hm=eS0wUnZFY2ZWRTJwRVA4bXNzOGxvNHdYUElZODBacTFEM35B

Request Chain 378

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmQQ3chq9qmAMI7lkQ8k9P41YDtuosJ0vcWsbX6Ely-k1l2PZoT7zivU7T9oIx4mn4OGKZttIpxmQrWmhwf5_lfE6xkMZ33rIQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQQ3chq9qmAMI7lkQ8k9P41YDtuosJ0vcWsbX6Ely-k1l2PZoT7zivU7T9oIx4mn4OGKZttIpxmQrWmhwf5_lfE6xkMZ33rIQ

383 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
forex.alghtas.xyz/
Redirect Chain

http://forex.alghtas.xyz/
https://forex.alghtas.xyz/

75 KB
16 KB

530ms
209ms

Document
text/html

162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

b3e5a81e78a5b3df3781c4a0166340557ec736ccc9ca2c61fb9e0dca4cdc12ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
link: <https://forex.alghtas.xyz/wp-json/>; rel="https://api.w.org/"
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-turbo-charged-by: LiteSpeed
x-xss-protection: 1; mode=block

Redirect headers

content-length: 707
content-type: text/html
date: Sat, 18 Nov 2023 00:46:22 GMT
keep-alive: timeout=5, max=100
location: https://forex.alghtas.xyz/
referrer-policy: no-referrer-when-downgrade
server: LiteSpeed
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-turbo-charged-by: LiteSpeed
x-xss-protection: 1; mode=block

GET
H2 200 style.min.css
forex.alghtas.xyz/wp-includes/css/dist/block-library/ 107 KB
14 KB 171ms
171ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-includes/css/dist/block-library/style.min.css?ver=6.4.1

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 13607
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Nov 2023 23:07:44 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 100 KB
31 KB 68ms
40ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b53f8bd5c74dde97821851bc0b2331e8ef34df22f280c53b9c042c75ea0f0d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31424
x-xss-protection: 0
server: cafe
etag: 203 / 19679 / 31079657 / config-hash: 16204867678510254442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:23 GMT

GET
H2 200 masterslider.main.css
forex.alghtas.xyz/wp-content/plugins/masterslider/public/assets/css/ 77 KB
10 KB 296ms
285ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/masterslider/public/assets/css/masterslider.main.css?ver=3.5.5

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

483600dac45a0560e87d8f10fc182b124b03b97a18a0eca2aa0ad0e83a60b9fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 9470
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 04 Jul 2021 18:42:52 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 custom.css
forex.alghtas.xyz/wp-content/uploads/masterslider/ 266 B
648 B 297ms
286ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/uploads/masterslider/custom.css?ver=1.1

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

1b4e2c3b84fe75916b109ac323d0eb39e3881a892f7b7a21970a0cb9e694b3d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 03 Oct 2023 23:19:41 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 266
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 css
fonts.googleapis.com/ 12 KB
1 KB 49ms
16ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,600%7CRoboto:400,500,400italic&display=swap

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

78b549dcb0e1d79020914936a2382debab3e87b4686de6864c0706f82b310e8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 18 Nov 2023 00:31:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Nov 2023 00:46:23 GMT

GET
H2 200 jquery.min.js Show response
forex.alghtas.xyz/wp-includes/js/jquery/ 86 KB
29 KB 650ms
640ms Script
application/javascript 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 29744
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Nov 2023 23:07:44 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 jquery-migrate.min.js Show response
forex.alghtas.xyz/wp-includes/js/jquery/ 13 KB
5 KB 650ms
640ms Script
application/javascript 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4678
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 09 Jun 2023 15:19:24 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 bs-icons.css
forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/ 5 KB
1 KB 296ms
287ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/bs-icons.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

20b2612ca01552a9905e6f056188b807d41f8afa567dfa064c1c63569a025986

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 879
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 style.min.css
forex.alghtas.xyz/wp-content/plugins/better-social-counter/css/ 54 KB
6 KB 297ms
287ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/better-social-counter/css/style.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

1583f28a50c73c0f65790ed46f422295ae9c61397fba7acd291e4d6487636909

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 5252
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 05 Jul 2020 09:37:06 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 slick.min.css
forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/ 1 KB
790 B 297ms
288ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/slick.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

6dcf5513db2216b938acffe6e78d51addb42160ad58c5d06206578a6fc251fa5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 387
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 font-awesome.min.css
forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/ 30 KB
7 KB 298ms
288ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/font-awesome.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

ed2d77ad6f19808e45fa19719a3818fa3f7c9f8f2e1accceefe0026d8376eab2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 6740
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 css
fonts.googleapis.com/ 233 B
329 B 49ms
17ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Oswald&text=0123456789./\%

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f015d154093e1cd0ac4cc4c9d9f8f304afcae6266d2c862d6275835f0b1ebee9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 18 Nov 2023 00:24:28 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Nov 2023 00:46:23 GMT

GET
H2 200 better-reviews.min.css
forex.alghtas.xyz/wp-content/plugins/better-reviews/css/ 14 KB
3 KB 298ms
289ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/better-reviews/css/better-reviews.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

f0887deac8c4b1acaadc22093dc98fc95cbb3b52b21c727fb5cba4203d56e880

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 2409
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 26 Jul 2021 17:41:36 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 financial-pack.min.css
forex.alghtas.xyz/wp-content/plugins/financial-pack-pro/css/ 169 KB
12 KB 453ms
444ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/financial-pack-pro/css/financial-pack.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

cece5b9224fbb6ce36a3770b9f8cb1749b409616fc382b14c4111b9ea575907c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 11939
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 26 Jul 2021 17:57:54 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 smart-lists-pack.min.css
forex.alghtas.xyz/wp-content/plugins/smart-lists-pack-pro/css/ 25 KB
3 KB 454ms
445ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/smart-lists-pack-pro/css/smart-lists-pack.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

84a1dbeab408381c75326559a1bd5712cc0ea089a2e753c825d19af2a660c2b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 2952
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 26 Jul 2021 18:16:14 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 wpep.min.css
forex.alghtas.xyz/wp-content/plugins/wp-embedder-pack/assets/css/ 42 B
423 B 454ms
446ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/wp-embedder-pack/assets/css/wpep.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

5ff02cd3b1882ce53cf8cb421e1bc13d73f094695591425d753530f52bb27fdd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 04 May 2019 15:41:26 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 42
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 pretty-photo.min.css
forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/ 7 KB
2 KB 454ms
447ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/pretty-photo.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

5c79b80ec32a532b360605538ac97c5b2b4fc85f57825582eff5318be177cca2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 1602
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:32 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 theme-libs.min.css
forex.alghtas.xyz/wp-content/themes/publisher/css/ 102 KB
16 KB 454ms
447ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/css/theme-libs.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

ed09e939fdfe0e6aeb1a27a6de975577b8856af406d240d38e7c0fd08d408ee9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 16112
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:18 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 style-7.11.0.min.css
forex.alghtas.xyz/wp-content/themes/publisher/ 556 KB
70 KB 488ms
481ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/style-7.11.0.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

8898fb76403a4c8c20809b386e768297f0f5da7a287d31ae036ea225fbc835a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 71615
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:18 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 style.min.css
forex.alghtas.xyz/wp-content/themes/publisher/includes/styles/pure-magazine/ 1 KB
979 B 615ms
609ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/includes/styles/pure-magazine/style.min.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

75737dd81c9731e837f2c3d6490b9961bfba625fd51813503bfd0fd95aa4266c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 576
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:30 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
H2 200 a82c789d67d513340efe11c1b6b2d286.css
forex.alghtas.xyz/wp-content/bs-booster-cache/ 45 KB
6 KB 616ms
610ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/bs-booster-cache/a82c789d67d513340efe11c1b6b2d286.css

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

9f9a51e343f2a6114278c254dd21c5f01648cd2d468e13c98e5c97f516f4cf89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:23 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 6058
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:13:13 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:23 GMT

GET
BLOB 200
OK 830d0f8e-f2b3-40cc-97ce-2558ee075f32
https://forex.alghtas.xyz/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://forex.alghtas.xyz/830d0f8e-f2b3-40cc-97ce-2558ee075f32
Requested by: Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/ 429 KB
135 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b04dfae5d49297b8b6a514bd8bf1c7bea7ebe622232401a5abed5a92809a2b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:37:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25754
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137535
x-xss-protection: 0
server: cafe
etag: 18342593356503948095
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 16 Nov 2024 17:37:09 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 180 KB
51 KB 396ms
396ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=207926523343629&correlator=409395624988549&eid=31079657%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22809522745%2Cforex.alghtas.xyz_interstitialll&enc_prev_ius=%2F0%2F1&prev_iu_szs=1x1&ifi=1&sfv=1-0-40&ists=1&fas=8&eri=5&sc=1&cookie_enabled=1&abxe=1&dt=1700268383751&adxs=-9&adys=-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fforex.alghtas.xyz%2F&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=2034059020.1700268384&ga_sid=1700268384&ga_hid=399945119&ga_fc=false&dlt=1700268383548&idt=165&adks=727936147&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

307ee842c964fc1d103df2ed1906b58c9f73cc685e644b4e570dd4aac9baea27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52263
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forex.alghtas.xyz
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 110 KB
44 KB 726ms
725ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=207926523343629&correlator=409395624988549&eid=31079657%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22809522745%2Cforex.alghtas.xyz_stickyy1&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x100%7C300x50%7C120x30%7C320x100%7C300x75%7C320x50%7C970x90%7C216x54%7C728x90&ifi=2&sfv=1-0-40&eri=4&sc=1&cookie_enabled=1&abxe=1&dt=1700268383757&adxs=650&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fforex.alghtas.xyz%2F&vis=1&psz=300x-1&msz=300x-1&fws=512&ohw=0&ga_vid=2034059020.1700268384&ga_sid=1700268384&ga_hid=399945119&ga_fc=false&dlt=1700268383548&idt=165&adks=2126799684&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9095c1b53b6dfe9409ee04f87bc321e739b659217251e3496bd4e7b5145d386d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45440
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forex.alghtas.xyz
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 60 KB
14 KB 1105ms
1105ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=207926523343629&correlator=409395624988549&eid=31079657%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22809522745%2Cforex.alghtas.xyz_stickyy2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C300x75%7C216x54%7C970x90%7C120x30%7C300x100%7C320x50%7C300x50%7C320x100&ifi=3&sfv=1-0-40&eri=4&sc=1&cookie_enabled=1&abxe=1&dt=1700268383760&adxs=436&adys=1170&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fforex.alghtas.xyz%2F&vis=1&psz=728x-1&msz=728x-1&fws=512&ohw=0&ga_vid=2034059020.1700268384&ga_sid=1700268384&ga_hid=399945119&ga_fc=false&dlt=1700268383548&idt=165&adks=3658310432&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

34b62ac29ff6ee85d0138a81f1353c669781e848df00753edd81f6dbfa9c9fd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14448
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forex.alghtas.xyz
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 107 KB
44 KB 1381ms
1380ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=207926523343629&correlator=409395624988549&eid=31079657%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22809522745%2Cforex.alghtas.xyz_PUSHhh&enc_prev_ius=%2F0%2F1&prev_iu_szs=120x20%7C120x60%7C300x100%7C120x30%7C300x50%7C320x100%7C320x50%7C300x75%7C320x75&ifi=4&sfv=1-0-40&eri=4&sc=1&cookie_enabled=1&abxe=1&dt=1700268383761&adxs=1280&adys=80&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fforex.alghtas.xyz%2F&vis=1&psz=300x-1&msz=300x-1&fws=512&ohw=0&ga_vid=2034059020.1700268384&ga_sid=1700268384&ga_hid=399945119&ga_fc=false&dlt=1700268383548&idt=165&adks=4130203354&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

690773c9f78f3c693f8fa7e428408d04f5c0d5539f013ecf43c19c7fe1ae318f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45155
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forex.alghtas.xyz
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 61A6 6 KB
3 KB 77ms
14ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/ 39 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl_page_level_ads.js?cb=31079657

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e329117bbdc12ee0649ed6654138a9ba8e600eaddf9138752631a50d236d135a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:37:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25747
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13750
x-xss-protection: 0
server: cafe
etag: 15254217830347453119
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sat, 16 Nov 2024 17:37:16 GMT

GET
H2 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 89E1 6 KB
3 KB 13ms
12ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 89E1 4 KB
767 B 17ms
17ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 23:23:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame E011 14 KB
1 KB 17ms
16ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 23:28:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame E011 2 KB
875 B 49ms
12ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55295
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:49 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame E011 23 KB
9 KB 45ms
9ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55295
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:49 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame E011 3 KB
1 KB 47ms
11ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37050
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame E011 20 KB
9 KB 44ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55296
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E011 202 KB
64 KB 69ms
46ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame E011 37 KB
16 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 03:47:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 334724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 13:20:26 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 12 Feb 2024 03:47:40 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 89E1 21 KB
9 KB 45ms
13ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:53:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24796
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8781
x-xss-protection: 0
server: cafe
etag: 9666818975682992898
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 17:53:08 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 89E1 205 B
295 B 29ms
10ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 13:09:15 GMT
x-content-type-options: nosniff
age: 41829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sat, 16 Nov 2024 13:09:15 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 89E1 604 B
921 B 28ms
9ms Image
image/png 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:53:46 GMT
x-content-type-options: nosniff
age: 183158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 14 Nov 2024 21:53:46 GMT

GET
H2 200 unVwOGQH9SsIcJBr4Xp3HcCvUJyc_uBy8Ir4YHk_V1Y.js Show response
pagead2.googlesyndication.com/bg/ Frame E1ED 38 KB
15 KB 51ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/unVwOGQH9SsIcJBr4Xp3HcCvUJyc_uBy8Ir4YHk_V1Y.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba7570386407f52b0870906be17a771dc0af509c9cfee072f08af860793f5756

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:02:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38634
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14990
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 14:02:30 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 98 KB
30 KB 173ms
173ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2823c17a2611bb4e0cbba265d7c41bf1e472e0a76f6b3989fb0827d25b022943

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30363
x-xss-protection: 0
server: cafe
etag: 313 / 19679 / 31079658 / config-hash: 16204867678510254442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H2 200 bs-icons.woff
forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/fonts/ 14 KB
14 KB 162ms
160ms Font
font/woff 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/fonts/bs-icons.woff

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/bs-icons.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

8bd7e75c205b1650b2b9feb33de1565ec74c9213a030f287e5005e726daf9d6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/bs-icons.css
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: font/woff
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 13852
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:24 GMT

GET
H2 200 fontawesome-webfont.woff2
forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/fonts/ 75 KB
76 KB 162ms
161ms Font
font/woff2 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/font-awesome.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forex.alghtas.xyz/wp-content/themes/publisher/includes/libs/better-framework/assets/css/font-awesome.min.css
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 18:29:32 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: font/woff2
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 77160
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:24 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 47 KB
47 KB 36ms
13ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600%7CRoboto:400,500,400italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:29:28 GMT
x-content-type-options: nosniff
age: 37016
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 14:29:28 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 29ms
6ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600%7CRoboto:400,500,400italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 14:45:25 GMT
x-content-type-options: nosniff
age: 381659
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Nov 2024 14:45:25 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 111 KB
46 KB 1039ms
1039ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=207926523343629&correlator=409395624988549&eid=31079657%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22809522745%2Cforex.alghtas.xyz_one&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C250x250%7C250x360%7C320x480%7C480x320&ifi=5&sfv=1-0-40&eri=4&sc=1&cookie=ID%3Dae5a259584b927bb%3AT%3D1700268383%3ART%3D1700268383%3AS%3DALNI_MblrixxAF3FXqCTxKqgZyM1qB4IZA&gpic=UID%3D00000ccb7af71f60%3AT%3D1700268383%3ART%3D1700268383%3AS%3DALNI_MaHdmn5MbhbijI223jsvh8i3lAzYA&abxe=1&dt=1700268384427&adxs=627&adys=76&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fforex.alghtas.xyz%2F&vis=1&psz=738x0&msz=738x0&fws=0&ohw=0&ga_vid=2034059020.1700268384&ga_sid=1700268384&ga_hid=399945119&ga_fc=false&dlt=1700268383548&idt=165&adks=368548625&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b13af0813c9f451df49143bd8c90c466cecfed02791371384e3ae9c0e085133b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46570
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forex.alghtas.xyz
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 13ms
8ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600%7CRoboto:400,500,400italic&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 23:30:11 GMT
x-content-type-options: nosniff
age: 350173
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Nov 2024 23:30:11 GMT

GET
H3 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7399 6 KB
3 KB 9ms
8ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame B69D 624 B
826 B 71ms
23ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhjasIP4ATAB&v=APEucNW3vrIIvlrOjhHhhjSoSFjOfd72GEkEhlaZyudJbu5ecpTSKqWLb-JH78QXQg9SaRSWyv1gRVBT0LzNEfsNdbsjMf9Grj6KebFLoSZ9wAiAMB2Rq2Wll9-4AUO17FtEQCH1e2Ltql4cHFGUYLQTaTMvjUGfV4Xqfu8JNF9ccaEVcag0eNM

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:24 GMT
expires: Sat, 18 Nov 2023 00:46:24 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 7399 111 KB
39 KB 69ms
8ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Origin: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 06:30:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65773
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 06:30:11 GMT

GET
H2 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 7399 7 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:55:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28226
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:55:58 GMT

GET
H2 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 7399 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14166
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 20:50:18 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 7399 41 KB
14 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 22:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6734
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 22:54:10 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 7399 3 KB
1 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37050
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 7399 20 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55296
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7399 42 B
173 B 46ms
43ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BPDAIkXaZlVaFFDEgNdZEZIYM07Zs1E3ejF3RSnTOllWOwhqNaPEeVjVUe_ZwNUNyLbQm5wwkpTkFFBm3vUOZa8uF9QHleDiYLltVZSAZfENjEdT4

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7399 202 KB
64 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame D00A 38 KB
13 KB 12ms
11ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 122499
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 14:44:45 GMT
expires: Fri, 15 Nov 2024 14:44:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 7399 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fcab446e7b0692310a0ba1932598df5d5bac964d7de3b05b0298c3e8038412b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame B69D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1

43 B
343 B

25ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhjasIP4ATAB&v=APEucNW3vrIIvlrOjhHhhjSoSFjOfd72GEkEhlaZyudJbu5ecpTSKqWLb-JH78QXQg9SaRSWyv1gRVBT0LzNEfsNdbsjMf9Grj6KebFLoSZ9wAiAMB2Rq2Wll9-4AUO17FtEQCH1e2Ltql4cHFGUYLQTaTMvjUGfV4Xqfu8JNF9ccaEVcag0eNM
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ym%2B%2BuYXD2%2FT7u7GHeSuCIaxSMF7llQco%2BpgpHKzhCe%2BJMuqZX8q9wF4Xs9OdPfe7DzkaeP0ZKC4yWfpIfHrQUNJpG03qIVw17UsyQigFMHOCJFpkbMp4KWE%2Boaj2%2FOvxIR56tjORUV06CA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 827c323d7bc469a3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame B69D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVgJYJJiT797tUzxZASq5gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1

43 B
774 B

19ms
19ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhjasIP4ATAB&v=APEucNW3vrIIvlrOjhHhhjSoSFjOfd72GEkEhlaZyudJbu5ecpTSKqWLb-JH78QXQg9SaRSWyv1gRVBT0LzNEfsNdbsjMf9Grj6KebFLoSZ9wAiAMB2Rq2Wll9-4AUO17FtEQCH1e2Ltql4cHFGUYLQTaTMvjUGfV4Xqfu8JNF9ccaEVcag0eNM
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bjKstmtfLTUeHQGMzFcjtsQXG9%2FDbQ%2BQSbgcGGfZ0%2BRxWOTMyoo%2BsysgofvjdsaZdUXyzooeVZLzWdOVy8ALy%2BZl057aI5Uy07C2%2FydGd6Skh3zpaDGx7IBPpwDSRh2dl%2FBBoOol6TLSWg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 827c323e0b36bb5f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKgWHdoLYny5hgJDixNQX_E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame B69D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEF2elGGabjdQhLrsdW2gu8I&google_cver=1

43 B
841 B

10ms
10ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEF2elGGabjdQhLrsdW2gu8I&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhjasIP4ATAB&v=APEucNW3vrIIvlrOjhHhhjSoSFjOfd72GEkEhlaZyudJbu5ecpTSKqWLb-JH78QXQg9SaRSWyv1gRVBT0LzNEfsNdbsjMf9Grj6KebFLoSZ9wAiAMB2Rq2Wll9-4AUO17FtEQCH1e2Ltql4cHFGUYLQTaTMvjUGfV4Xqfu8JNF9ccaEVcag0eNM

Protocol

Server

37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
an-x-request-uuid: 1ecb3e5a-d240-4742-adf0-e7d7613050f1
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.198; 80.255.10.198; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEF2elGGabjdQhLrsdW2gu8I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame B69D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

170 B
243 B

19ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:24 GMT
an-x-request-uuid: c2ed0075-af3b-4228-8dd0-71e3212f66c0
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D
x-proxy-origin: 80.255.10.198; 80.255.10.198; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 7399 9 KB
4 KB 110ms
10ms Script
application/javascript 2a02:26f0:3500:d::1732:83c8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:d::1732:83c8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 8ab43ef523c52e830a7706ae32581ae882ebe14920d3e88ee191ac6aea78c401

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sat, 18 Nov 2023 00:46:24 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Nov 2023 14:21:20 GMT
Server: UploadServer
ETag: "4fd30d56128c4e7705e200cd98cfb057"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3639
Expires: Sat, 18 Nov 2023 01:01:24 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/ Frame 4826 6 KB
2 KB 27ms
7ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d4f28083f752036e12cd7c6e668a8035e9b05c08ba515cbb5f70376ea46c71d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 44197
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1874
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 12:29:47 GMT
expires: Sat, 16 Nov 2024 12:29:47 GMT
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 7399 0
0 166ms
54ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuYYdSlDlOkOShFz-043upuJ6DjvY_dvmcTeLKhJApePaZJ1PHD35dBhJBbQI7ESAZgBe9uMvFgaRnCYtnozzxoT2UisYyxi0-zKHYoiicHO2WIhwrMkX6TL79nbP8W49606D-6uKvagmgSGMjqjn49vGsUwfP6oByXd4KaLQJj5xuYb5Fsir4EMmh4Vdhr75U_FwFIi-iR3ljfEehPsWa4oatXZjv8laPC5a4qhpi_5x3dXmOAePnvp_Hw5v3pZwp6mJe6MKQcgU1YoMalFs8jso7LjeZ0ddX8V5HdGy_297sg3MrRvCadCc4losLhUj_SfOqudFiNCi5R1z9uIgJb0ozhh6hocVrnrx1uiS3HGeEgaHeCjAJDuwkJaZ-9J7z6btJ9BAGNO7gBaaFhivR5IPRJTU0F2-zYvdKQY9j9HC4_98ca51Dw2hzOAJ2ef1BVqdhFabsxcfQMzD7EC3EuSf4WEPzG8lfTTqsM7Mf-Ve-pYyvhEyRI8JZ55d9y67SG0dSDW5H8-QDvnINjlhqw78xjztjhVSUKT2fjl1vNlTk8fB5VPHFDkYTI5m-aIIeB9gEZiR9NyAfncQDhLYgjxHd11e-KS-rb_xqxeDjtybu7gb8zGcjKj7lA0JgdQZEq8orSvc75q5ErwymeYqVplinwur39zuADlRv6QxEx1Ew7iGnXauvUN6-7E14DkjFgeRVUUthc7tovTW3z08IaWCuhyQO2ZLVAHqQheAGXj4JmgB4fVNquO6qQMHBiILhmRq895BVuMn-iEkIeLhe7GJ0xTc1-OjrQvaBLNIeygtrCCT11H9V1d3poJaE9ksKQ6thH31QSqQoX4Qdgi56hKvOIwMXrdtzEF8y7dENhNdARlcWQq1UBRL0JRO9rjL4M7aL8PkZrN5RLit4K0iolY8jJ8-QYnHyXmAg7IFXNG-cer71jNktm-q8G-hPEKiu2xu0pZbl8d0ikC6gwUTgHBwad5HqR-IR4uec0OUC_A4keP83fVY7g2zw_ebxryCzuJMPYIbybB9-D-Cl0jQMtKK0UDiqGHFpQUGrpfIBevqjdaoG-v9Lf_IXgdEB-tA6zH93aiN19TR8sCIT0tR91COdvTnJUWsHQ3Zat84gb3pIQImBvXVaAztrd7g18LH2NIdWzDdYLzaqGZTFmUdOVBEvSKOnIyio9F86LUsEqYEU9YE5pVGhizSbvkenf1M32PHzz31hhiZupS-WBFV0gpu_1hikbVnxv-Nq-ne01lBztWuCd7siJG5flBkgcQmqPj9ou9sULvXrHRVkwtJ1Iw42vFelkR8kb8N9yec24S2LfLrr0WGkVb2HC10m3fzp7hE4cdStU_J51GtqrpnrjdOJrlYPxEjAxEsyhBdJsMioowHd6AwP1wGnAENMkSOwDbvgU2b3VcIX-9g-Inhpp&sai=AMfl-YRsSvPFyAmcCHASsii43AtI73ytZoq3DJy9Jfme0Z8mee-xmysHWK1xLEXaZa4cJonmOoOa9_U_UTuscmNj_xK1bj-A0Zdnkx_m7tOhO2W46hRquVYkenOmNEWgqajL7M_6LR29jPSTfDVVFJvc5RXXJvg0zZNRZGS7t51TCXLS31wf9hBofgjDq8gjmdlJyYnKASLhmvf1TLfPDndGT2MFzpndVOdYpgf25tsCvdIRiXJyGotm7vEOFysO2pq2eyUSbdlRVRNCQPVyIDsY3nmW4sq6Z8mUQL6J-APvy4l9PpPZnpSaTbha5B8MisqAKREhGePLwBCl__orOLERn9FlNrH94errHWjFrII171VlzU3jfbSN63K8TskoFIIqigPZ7TrDqkbHvFu5b7X0yIDkahxvhegqQQ4rzvmNevI3-VS-lZRJergN3dw7QZFnpFavLP9HzppnGRQGRYR6vJDvhMQi3PnINvjrkIiWepKI9RJyGn3Hx-g0AUMRu3G1MBBSXaS5VvDz&sig=Cg0ArKJSzEI753ddwhXiEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9oeXVuZGFpLmNvbQ&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=139&cbvp=1&cstd=137&cisv=r20231109.10323&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 18 Nov 2023 00:46:24 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

204

tp.gif
1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net/ Frame 7399
Redirect Chain

https://pixel.de-config.sensic.net/tp?ty=IM&optin=false&m=campaign_116_de&c=11600102&pr=1732803402&gdpr=&gdpr_consent=
https://1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net/tp.gif?m=campaign_116_de&r=pixel.de-config.sensic.net&p=de1&instanceid=1700268384848AD999FBF64E5AE9E2AA136F725820B903...

0
364 B

63ms
16ms

Image
text/plain

2600:9000:2644:8c00:1f:f009:8540:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net/tp.gif?m=campaign_116_de&r=pixel.de-config.sensic.net&p=de1&instanceid=1700268384848AD999FBF64E5AE9E2AA136F725820B903AC08B978B3
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:2644:8c00:1f:f009:8540:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
via: 1.1 146c0f4d7da9f5b3108ac41c3becbb82.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA60-P6
x-cache: Miss from cloudfront
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: *
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: r33vy1gw5Vjir-U7H5MQZZHCf0FzfUWZCjFT2KXVwwdmpJLq-A_gPA==
expires: Wed, 21 Oct 2015 07:28:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:24 GMT
via: 1.1 29f7132906866b79866659848b3a3b68.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P3
x-cache: Miss from cloudfront
location: https://1700268384848AD999FBF64E5AE9E2AA136F725820B903AC08B978B3.trk.sensic.net/tp.gif?m=campaign_116_de&r=pixel.de-config.sensic.net&p=de1&instanceid=1700268384848AD999FBF64E5AE9E2AA136F725820B903AC08B978B3
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 0
x-amz-cf-id: oExJH0_3vsk-BmUF1Yh-qbFo_jkJwx1CmcZMTcfk1OMuzhx2gbKjUQ==

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame D00A 39 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27406
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 98 KB
30 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d127f785466a5f2cb05370e0ed70047d4668422733c96e3c8cf903c4239efd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30364
x-xss-protection: 0
server: cafe
etag: 572 / 19679 / 31079744 / config-hash: 16204867678510254442
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 47 KB
12 KB 966ms
966ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=207926523343629&correlator=409395624988549&eid=31079657%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22809522745%2Cforex.alghtas.xyz_five&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x480%7C480x320%7C250x250%7C250x360%7C320x50&ifi=6&sfv=1-0-40&eri=4&sc=1&cookie=ID%3Decb0dba2835316ed%3AT%3D1700268383%3ART%3D1700268383%3AS%3DALNI_MasQbX-kHnCE8wyc4PBNZzwxdiQ9w&gpic=UID%3D00000ccb7b036104%3AT%3D1700268383%3ART%3D1700268383%3AS%3DALNI_MbcP1vthaC9QFbjYaK-k9E4DRP3XA&abxe=1&dt=1700268384761&adxs=234&adys=1231&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fforex.alghtas.xyz%2F&vis=1&psz=1132x0&msz=1132x0&fws=0&ohw=0&ga_vid=2034059020.1700268384&ga_sid=1700268384&ga_hid=399945119&ga_fc=false&dlt=1700268383548&idt=165&adks=26213238&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

019a22e01a8d0e032c7b7a9ebb128430d037896a448a1548a05feab293ddea35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12173
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forex.alghtas.xyz
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rs6.css
forex.alghtas.xyz/wp-content/plugins/revslider/public/assets/css/ 58 KB
12 KB 160ms
158ms Stylesheet
text/css 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.5.5

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

6abe94c8db415593d42b093301152b1e9c727364c2b5ed05b5ca2f163d8aa747

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 11854
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Jul 2021 17:48:30 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:24 GMT

GET
H2 200 rbtools.min.js Show response
forex.alghtas.xyz/wp-content/plugins/revslider/public/assets/js/ 121 KB
45 KB 168ms
166ms Script
application/javascript 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/revslider/public/assets/js/rbtools.min.js?ver=6.5.5

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

87664d848161d3a5bf83a511f4f483dc05e8472d06aedd5111488d267af298bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 45569
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Jul 2021 17:48:30 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:24 GMT

GET
H2 200 rs6.min.js Show response
forex.alghtas.xyz/wp-content/plugins/revslider/public/assets/js/ 367 KB
92 KB 176ms
174ms Script
application/javascript 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/revslider/public/assets/js/rs6.min.js?ver=6.5.5

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

e4efcd6ec7d1fc476d9d3f43480ec9fb2b37ebcca255edefd2cfad8d2a96c27a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 94096
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 21 Jul 2021 17:48:30 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:24 GMT

GET
H2 200 advertising.min.js Show response
forex.alghtas.xyz/wp-content/plugins/better-adsmanager/js/ 29 B
424 B 166ms
164ms Script
application/javascript 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/plugins/better-adsmanager/js/advertising.min.js?ver=1.21.0

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

c7e76d44c88e8c172f66eb413a359494fdc7569ebac417ac2de0c2a232152dd8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 29 Jul 2021 16:17:34 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 29
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:24 GMT

GET
H2 200 73a371156003dfa9d63ee26c5aa0fbf4.js Show response
forex.alghtas.xyz/wp-content/bs-booster-cache/ 338 KB
95 KB 325ms
323ms Script
application/javascript 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-content/bs-booster-cache/73a371156003dfa9d63ee26c5aa0fbf4.js?ver=6.4.1

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

5ee042f559ab7fd95fc25a01797239fefc0bb4b70e1b6f7bd53a13cb68e5ac07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 96510
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 03 Oct 2023 23:22:01 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:24 GMT

GET
H/1.1 200
OK dv-measurements4946.js Show response
cdn.doubleverify.com/ Frame AC02 424 KB
100 KB 11ms
10ms Script
application/javascript 2a02:26f0:3500:d::1732:83c8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements4946.js
Requested by: Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:d::1732:83c8 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: 532cc63b02ed8f53da56d150a5e594a9a7bc44334a376556f9ffd2d5078197f0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sat, 18 Nov 2023 00:46:24 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Nov 2023 11:28:09 GMT
Server: UploadServer
ETag: "207db46e6ac0ca4732907f40bbd2d096"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 102043
Expires: Sun, 17 Nov 2024 00:46:24 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 4826 60 KB
24 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/js/ Frame 4826 2 KB
767 B 14ms
14ms Script
application/x-javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3fbac6f606aa2da2e896ca92b5809ded0973fe1a6fb964fe56b59d69870edf3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:53:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31984
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:53:20 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012310301456000/ Frame FA04 196 KB
56 KB 72ms
8ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 02:37:57 GMT
age: 79707
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56081
x-xss-protection: 0
server: sffe
etag: "6a17d296884b026a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 02:37:57 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame FA04 15 KB
5 KB 84ms
20ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 14 Nov 2023 05:14:53 GMT
age: 329491
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0
server: sffe
etag: "0b7142e00666043e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 13 Nov 2024 05:14:53 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame FA04 95 KB
29 KB 85ms
22ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 03:53:12 GMT
age: 75192
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29077
x-xss-protection: 0
server: sffe
etag: "7b1f1965b6cd6fda"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 03:53:12 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame FA04 5 KB
2 KB 92ms
29ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 01:14:32 GMT
age: 84712
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5b0a82507b260c6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 01:14:32 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame FA04 40 KB
13 KB 93ms
30ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 16 Nov 2023 14:54:32 GMT
age: 121912
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12952
x-xss-protection: 0
server: sffe
etag: "9817e561a46c70fa"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 15 Nov 2024 14:54:32 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame FA04 4 KB
655 B 29ms
29ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 18 Nov 2023 00:46:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 23:28:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Nov 2023 00:46:24 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FA04 2 KB
2 KB 8ms
8ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 26908
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 18 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FA04 295 B
319 B 7ms
7ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 11386
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 18 Nov 2023 21:36:38 GMT

GET
H3 200 6592766407814317453
tpc.googlesyndication.com/simgad/8161909537371852161/ Frame FA04 48 KB
48 KB 80ms
79ms Image
image/jpeg 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8161909537371852161/6592766407814317453

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f8511dfa5913b237ead640f66cd5eaa417896f814c100dce797d3afe675c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:24 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49064
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 08:29:40 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 17 Nov 2024 00:46:24 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/8556543448356904683/ Frame FA04 1 KB
1 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8556543448356904683/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

596f5fe07ada5d8ae7423c1dcb901e556245326d2bf2196df38193cbf9cd11ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 23:08:07 GMT
x-content-type-options: nosniff
age: 5897
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1426
x-xss-protection: 0
last-modified: Wed, 05 Jul 2023 05:50:34 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 16 Nov 2024 23:08:07 GMT

GET
DATA 200
OK truncated
/ Frame FA04 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f21faedddd30758df150bb8fa894e91026cb3cfecc9b346052baf7d22c35fff9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK visit.js Show response
tps.doubleverify.com/ Frame AC02 1008 B
914 B 148ms
30ms Script
text/javascript 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=159&ttfrms=19&brid=3&brver=119.0.6045.159&bridua=3&bds=1&tstype=128&eparams=DC4FC%3Dl9EEADTbpTauTau7%40C6I%5D2%3D89E2D%5DIJKTauU2%3F4r92%3A%3Fl9EEADTbpTauTau7%40C6I%5D2%3D89E2D%5DIJKTar9EEADTbpTauTaudhh62_3hdggfah3%60%605a2h37d5c75h_b_%5DD2767C2%3E6%5D8%40%408%3D6DJ%3F5%3A42E%3A%40%3F%5D4%40%3E&srcurlD=0&aUrlD=0&ssl=https:&dfs=169&ddur=115&uid=1700268385029592&jsCallback=dvCallback_1700268385029792&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=90&winw=728&wouh=1200&wouw=1600&scah=1200&scaw=1600&jsver=4946&tgjsver=4946&lvvn=28&m1=13&refD=1&referrer=https%3A%2F%2F599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&fcifrms=4&brh=2&dvp_epl=219&noc=4&nav_pltfrm=Win32&ctx=26387868&cmp=30537616&sid=5952739&plc=376181600&crt=198996466&btreg=567181304&btadsrv=doubleclick&adsrv=1&advid=9758366&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=6026363282.536106&ee_dp_sukv=6026363282.536106&dvp_tukv=34899073411.29896&ee_dp_tukv=34899073411.29896&dvp_strhd=0.29999542236328125&dvpx_strhd=0.29999542236328125&dvp_tuid=813827977045&jurtd=3996552411
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dv-measurements4946.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: f259c256b7e0066658547c031f67d5ded671915621353191943529b547b242cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 18 Nov 2023 00:46:25 GMT
Content-Encoding: br
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 11/17/2023 00:46:25

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame FA04 15 KB
16 KB 14ms
14ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:39:21 GMT
x-content-type-options: nosniff
age: 29224
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 16:39:21 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame FA04 15 KB
15 KB 14ms
13ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 23:30:11 GMT
x-content-type-options: nosniff
age: 350174
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 12 Nov 2024 23:30:11 GMT

GET
H2 200 view
ad.doubleclick.net/pcs/ Frame 7399 0
0 46ms
44ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuYYdSlDlOkOShFz-043upuJ6DjvY_dvmcTeLKhJApePaZJ1PHD35dBhJBbQI7ESAZgBe9uMvFgaRnCYtnozzxoT2UisYyxi0-zKHYoiicHO2WIhwrMkX6TL79nbP8W49606D-6uKvagmgSGMjqjn49vGsUwfP6oByXd4KaLQJj5xuYb5Fsir4EMmh4Vdhr75U_FwFIi-iR3ljfEehPsWa4oatXZjv8laPC5a4qhpi_5x3dXmOAePnvp_Hw5v3pZwp6mJe6MKQcgU1YoMalFs8jso7LjeZ0ddX8V5HdGy_297sg3MrRvCadCc4losLhUj_SfOqudFiNCi5R1z9uIgJb0ozhh6hocVrnrx1uiS3HGeEgaHeCjAJDuwkJaZ-9J7z6btJ9BAGNO7gBaaFhivR5IPRJTU0F2-zYvdKQY9j9HC4_98ca51Dw2hzOAJ2ef1BVqdhFabsxcfQMzD7EC3EuSf4WEPzG8lfTTqsM7Mf-Ve-pYyvhEyRI8JZ55d9y67SG0dSDW5H8-QDvnINjlhqw78xjztjhVSUKT2fjl1vNlTk8fB5VPHFDkYTI5m-aIIeB9gEZiR9NyAfncQDhLYgjxHd11e-KS-rb_xqxeDjtybu7gb8zGcjKj7lA0JgdQZEq8orSvc75q5ErwymeYqVplinwur39zuADlRv6QxEx1Ew7iGnXauvUN6-7E14DkjFgeRVUUthc7tovTW3z08IaWCuhyQO2ZLVAHqQheAGXj4JmgB4fVNquO6qQMHBiILhmRq895BVuMn-iEkIeLhe7GJ0xTc1-OjrQvaBLNIeygtrCCT11H9V1d3poJaE9ksKQ6thH31QSqQoX4Qdgi56hKvOIwMXrdtzEF8y7dENhNdARlcWQq1UBRL0JRO9rjL4M7aL8PkZrN5RLit4K0iolY8jJ8-QYnHyXmAg7IFXNG-cer71jNktm-q8G-hPEKiu2xu0pZbl8d0ikC6gwUTgHBwad5HqR-IR4uec0OUC_A4keP83fVY7g2zw_ebxryCzuJMPYIbybB9-D-Cl0jQMtKK0UDiqGHFpQUGrpfIBevqjdaoG-v9Lf_IXgdEB-tA6zH93aiN19TR8sCIT0tR91COdvTnJUWsHQ3Zat84gb3pIQImBvXVaAztrd7g18LH2NIdWzDdYLzaqGZTFmUdOVBEvSKOnIyio9F86LUsEqYEU9YE5pVGhizSbvkenf1M32PHzz31hhiZupS-WBFV0gpu_1hikbVnxv-Nq-ne01lBztWuCd7siJG5flBkgcQmqPj9ou9sULvXrHRVkwtJ1Iw42vFelkR8kb8N9yec24S2LfLrr0WGkVb2HC10m3fzp7hE4cdStU_J51GtqrpnrjdOJrlYPxEjAxEsyhBdJsMioowHd6AwP1wGnAENMkSOwDbvgU2b3VcIX-9g-Inhpp&sai=AMfl-YRsSvPFyAmcCHASsii43AtI73ytZoq3DJy9Jfme0Z8mee-xmysHWK1xLEXaZa4cJonmOoOa9_U_UTuscmNj_xK1bj-A0Zdnkx_m7tOhO2W46hRquVYkenOmNEWgqajL7M_6LR29jPSTfDVVFJvc5RXXJvg0zZNRZGS7t51TCXLS31wf9hBofgjDq8gjmdlJyYnKASLhmvf1TLfPDndGT2MFzpndVOdYpgf25tsCvdIRiXJyGotm7vEOFysO2pq2eyUSbdlRVRNCQPVyIDsY3nmW4sq6Z8mUQL6J-APvy4l9PpPZnpSaTbha5B8MisqAKREhGePLwBCl__orOLERn9FlNrH94errHWjFrII171VlzU3jfbSN63K8TskoFIIqigPZ7TrDqkbHvFu5b7X0yIDkahxvhegqQQ4rzvmNevI3-VS-lZRJergN3dw7QZFnpFavLP9HzppnGRQGRYR6vJDvhMQi3PnINvjrkIiWepKI9RJyGn3Hx-g0AUMRu3G1MBBSXaS5VvDz&sig=Cg0ArKJSzEI753ddwhXiEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9oeXVuZGFpLmNvbQ&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=571&vt=11&dtpt=432&dett=3&cstd=137&cisv=r20231109.10323&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 txt1.png
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 9 KB
9 KB 8ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/txt1.png

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1dd81ca0515d290c7ff168f90884270ca75263bc960f4b22f8b5980022eb38a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:53:20 GMT
x-content-type-options: nosniff
age: 31985
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8915
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:53:20 GMT

GET
H3 200 logo.svg
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 2 KB
1 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/logo.svg

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aaa41c92c5a8c4640b5bb2173ac6694f87c298913f4defbc6fb837314022579b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:53:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31985
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1010
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:53:20 GMT

GET
H3 200 bg1.jpg
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 13 KB
13 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/bg1.jpg

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2a1e51b39610b1ce9fa2034995f814490d2b5e0ec9c81a7cdc5afd8e052563bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 04:12:46 GMT
x-content-type-options: nosniff
age: 74019
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13397
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 04:12:46 GMT

GET
H2 200 wp-emoji-release.min.js Show response
forex.alghtas.xyz/wp-includes/js/ 18 KB
5 KB 165ms
165ms Script
application/javascript 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL

https://forex.alghtas.xyz/wp-includes/js/wp-emoji-release.min.js?ver=6.4.1

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload;
content-length: 4651
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 02 Feb 2023 11:23:26 GMT
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H3 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1609 6 KB
3 KB 12ms
10ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FA04 2 KB
2 KB 11ms
7ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 26909
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 18 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame FA04 295 B
319 B 12ms
7ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 11387
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 18 Nov 2023 21:36:38 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame D50C 624 B
391 B 27ms
20ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCZw2EY2r2g5QEwAQ&v=APEucNXBhywvRvA_kbIsMfcM_L4pM6UKmGbScW8W6O3bclmBZRNsOjJziAv6wud1gSX5vVQmEFNl1va8uslXBLDb0qze9TwyXDicdaADatjeqzYlkXMxEw91UXXB-eI04hAvzuutcQiT9bsAXH7mA1B6vFsVRyfZSzoxwbuKdvWk7dLwKG_6HWs

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:25 GMT
expires: Sat, 18 Nov 2023 00:46:25 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 1609 111 KB
39 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Origin: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 06:30:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65774
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 06:30:11 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 1609 7 KB
3 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:55:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28227
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:55:58 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 1609 23 KB
9 KB 13ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14167
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 20:50:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 1609 41 KB
14 KB 11ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 22:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6735
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 22:54:10 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 1609 3 KB
1 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37051
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 1609 20 KB
8 KB 11ms
9ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55297
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1609 42 B
63 B 44ms
42ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CIpBYv8P6hGpcnPIUYz7anIDn5Nl6NwWuqrz-LS8m30qqoN9Pyq1ID9V8Jcg0qSBft2yRHm1eGD5k49isdUpi083-kIKsLYIeB3n49rLhiWLuQfnE

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1609 202 KB
64 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:25 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/webp

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D50C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

43 B
736 B

25ms
25ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCZw2EY2r2g5QEwAQ&v=APEucNXBhywvRvA_kbIsMfcM_L4pM6UKmGbScW8W6O3bclmBZRNsOjJziAv6wud1gSX5vVQmEFNl1va8uslXBLDb0qze9TwyXDicdaADatjeqzYlkXMxEw91UXXB-eI04hAvzuutcQiT9bsAXH7mA1B6vFsVRyfZSzoxwbuKdvWk7dLwKG_6HWs
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uojYxIJLw79ynYyT8f8tJCfMSDfnqkfILXolo94rJIj%2FCawfY9sWxX%2FqExKp7%2FIStExzVopNVFZVMmYW6oibGfu42HdnH36cwkzjbcnhLf5TXlPf6X9mFnOKE0b0tlTUNo%2BD%2FuVH1hSWtg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 827c3241acc8bb5f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame D50C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVgJYJJiT797tUzxZASq5gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

43 B
737 B

24ms
23ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCZw2EY2r2g5QEwAQ&v=APEucNXBhywvRvA_kbIsMfcM_L4pM6UKmGbScW8W6O3bclmBZRNsOjJziAv6wud1gSX5vVQmEFNl1va8uslXBLDb0qze9TwyXDicdaADatjeqzYlkXMxEw91UXXB-eI04hAvzuutcQiT9bsAXH7mA1B6vFsVRyfZSzoxwbuKdvWk7dLwKG_6HWs
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cxFU%2B2%2B1f8e%2BGJj5s3HHLTMj6t%2BqoXMKLBM7kUsNbADL6wHb4oIKmmuetXDB1jTbhHfjeKoA2cBlyBA2U7bkcfAv%2Be%2BBA2pVRiCCP3c7xKbdBQsnwZjr0euDPbDraOuGvWuMlY9SsuUp%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 827c3241dcd7bb5f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame D50C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1

43 B
843 B

8ms
7ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxCZw2EY2r2g5QEwAQ&v=APEucNXBhywvRvA_kbIsMfcM_L4pM6UKmGbScW8W6O3bclmBZRNsOjJziAv6wud1gSX5vVQmEFNl1va8uslXBLDb0qze9TwyXDicdaADatjeqzYlkXMxEw91UXXB-eI04hAvzuutcQiT9bsAXH7mA1B6vFsVRyfZSzoxwbuKdvWk7dLwKG_6HWs

Protocol

Server

37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
an-x-request-uuid: 024442cd-5a6f-482a-b70e-74593f163d7f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.198; 80.255.10.198; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D50C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
an-x-request-uuid: 61dd007a-cada-43b7-b85a-7dc76162a1c3
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D
x-proxy-origin: 80.255.10.198; 80.255.10.198; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 8-750x430.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 42 KB
42 KB 164ms
162ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/8-750x430.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

6f01eb26f54351d53cf482e3e292b7f739c7193a69165dce82bbcef77ce804a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:48:26 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 42762
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H2 200 7-279x220.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 10 KB
10 KB 172ms
170ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/7-279x220.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

db2282c7f9b938aceabbad4422ad9dd74390aacbb5730e0a2dd42abd37202ee3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:48:20 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 9854
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H2 200 6-279x220.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 13 KB
14 KB 172ms
171ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/6-279x220.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

780ec0d1b2ad933e794cae2465317c58cfc86ac7191c2c450e62ed94683a0abc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:48:14 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 13619
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H2 200 5-279x220.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 11 KB
12 KB 170ms
169ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/5-279x220.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

9c6fdee436c01218d40d57e11c8a123880671323c6b2b2d73ffdf04d45a2a55f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:48:06 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 11565
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H2 200 4-279x220.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 11 KB
11 KB 171ms
170ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/4-279x220.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

b573a1c9614ddaea83c8617720f1c133bffc92093b37ebb4abb0df9b546805c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:47:54 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 11319
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H2 200 3-210x136.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 4 KB
4 KB 176ms
175ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/3-210x136.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

8bc683ec7ab9dd68962a2c387fa15928e782171e433a18be6d7ff884288e01c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:47:31 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 3668
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H2 200 2-210x136.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 3 KB
3 KB 177ms
176ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/2-210x136.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

f3236d5878ad1a21e043d4b7d323103b1695ef9ab1e175543e3f79c5a47aea7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:47:19 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 3187
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H2 200 1-210x136.jpg
forex.alghtas.xyz/wp-content/uploads/2023/10/ 7 KB
8 KB 172ms
171ms Image
image/jpeg 162.0.209.219
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forex.alghtas.xyz/wp-content/uploads/2023/10/1-210x136.jpg

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

162.0.209.219 , United States, ASN22612 (NAMECHEAP-NET, US),

Reverse DNS

business96-2.web-hosting.com

Software

LiteSpeed /

Resource Hash

7ffe4c22b2d19e8acf7c7b334bc80e24807cb3ec801a997218706a74b0cd61bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload;
x-content-type-options: nosniff
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 04 Oct 2023 00:46:57 GMT
server: LiteSpeed
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
accept-ranges: bytes
content-length: 7376
x-xss-protection: 1; mode=block
expires: Sat, 25 Nov 2023 00:46:25 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D00A 0
20 B 45ms
44ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B8flLYAlYZYjaB83k7_UP_9GF2AUAAAAAOAHgBAI&bg=!CQqlCkXNAAZxrfrxUa07ADQBe5WfOEU6wYXs3vugLJ-O3FYa-EjShN3epaAcv7gpDUgcGHDIumapz8qPrPZZ1VegR4mGAgAAAhpSAAAACGgBB5kC_HZTjBxbxhIMugORQZDcYIA8SyXJkEDsCC1WNE7xC0X9ymaJGbEDwN5svuT4NT2myf_xT2V18Sj-29klFvxocDLvEBoYpv3JaJALUVziluzdztMqQKDrLU9sAU6nntoAsPNuYksEtgG49Eo_67u0kwzRjz_rhsaeAbUMl2Spz_6KNq-cyPhoAMk51v8eaDEgYQV29htk-pJZhQUbHv921B4T62p_lmzd3L-5FjRCBfz0mUYgVHlXBszJ277qg187YGYmbSjYq7cc21UazrNi8TxpUeZf9T1qG9UabIaX_A8wgge7mRiQGaOuEif_TZiNgJe_f1hh7paPOJ0ZyioQ4V-L6ppRMbicuFFkqPqnIQ85TC9FI7JohGuzoNfb2vClGaK6Q4Bp8HMcZoQpmAzKxpofGO4_cWKHq-ofG7WXzBhb0ioVr78YU6Q1bi7uepAKDOT5AWswaywL-PYe-Dlf4tZcb85QyC-E5sn8zhud7Alj-mulsXzS9YBnzqegNrMYx-wMAyeopr3OZzNC6zUq225LPJjeZi7iCKoO8uAcRV3uWzMtk5KtmdiOz95i-2k70ccXq9yHspWG6QzuQaJ4jAl88QrvrXPctfrNJtMdZH3gemtL0pqa7lF2Z_GFDl34HrNOc5bLZoAoOuTBvjQkHPD_Ae713qQBbKH3W1ybu_D4CbTTMH44rK4UC-eVHQBs52G79M-1Z2VSPYtGjTQ_9-u2qleZtY8ocIe0_W9AqonSx0pquflGelox0FyvTcdgxBJXOb0p98RPWOLzsDHM-LZqo_1UoP7p8NEaVI1xx0kC6Px1KBVh-DP9vdjkQu2i-X3c8niqVYibtEHxnrGZLkcVwTVrQeNp3vi6fh9jOLmOnlwDWakXVybktsR1cSmkG4LkuXxPUPD4qxG2_O4xWhlHqIkBa4hK1phE-ddAI8GM1XhBvhor_x7Hz4fDQy_GVRZwlpGXg4tKwVB-L8Ti_rCG207PwUmJquNStGpSvg6Es0EQBO3jC_zNbWqx

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DB9D 6 KB
3 KB 17ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame FA04 0
0 55ms
54ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C7rgxYAlYZZnzG5iL7_UPrMWVsAK00euedPD7wIymEtrZHhABIN7BgJsBYJWqn4KwB6AB3vGi-SjIAQmpAl58OYvCQLI-4AIAqAMByAMKqgSKAk_QHejQXMDTtqVXY7FyvupDBhOlqgt9cYiJHKycinZCbIIl22eVEgZBxlVqv2nkCmN1SKbZQtm8KfwoCtuAW0W49GcBuvybIvDa964zPPeyRzMCdyCgzU0EulzAziCvn4iYa6o92k-aNPdr0m4QFB2vSe_W0vM2KTQmTVvVPPxHWSR0suxrebZZoG7FzfTtvgv7pyB5g9XhqCwjOC6rtXbxvYWZ7H6waTJc2F6-IW40GFOWPiU3SbLgLBrDDpbgoLUWRDzDssR0IgbJ2RRNjZ8IOlYUdk61WaQnLw32F2LDdLn9OVG4TjzJ0hQ1rV-i04-1L1QkSo2nFpgVY0iB0mp04Mmz4cFwMrSowASuq-GKvQTgBAGIBZrJs5BNkgUECAQYAZIFBAgFGASgBi6AB96p89gDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQjPxO0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOpoJQWh0dHBzOi8vdm1lLWFjY2VudGxpbmUtenVnYWJlYWt0aW9uLnNvY2lhbHBhbHMuZGUvMTA2ODM_Y19pZD00MjE0gAoDyAsBogwQKg4KDOS0sQLutbECtbixAuINEwjY9qaoqcyCAxWYxbsIHaxiBSa4E-QD2BMKiBQC0BUBgBcBshcfCh0IABIUcHViLTc3ODA3NTg1Mzk3NTEyNDMYoKiLAQ&sigh=CxPuIckGdqQ&uach_m=[]&ase=2&nis=5&cid=CAQSTgDICaaN28IgB7EPAYGk5iPJNvRl0qyE05-HQ_F0pczeCYQ0NpGHGr_yc0eGD50GV6CuQs8BIhNiJeW0WOi1P2i5Z85w7HFvZwTnuDVYaxgB&template_id=484&cbvp=2
Requested by: Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/16803923726020142021/ Frame BFB2 28 KB
5 KB 19ms
10ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29b0c3bf4a426a6a90d55c87ad783d8d06dce0aa7f36dfff406790272c8eae23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 32695
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5161
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 15:41:30 GMT
expires: Sat, 16 Nov 2024 15:41:30 GMT
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 1609 0
0 54ms
54ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuTczNwJiLTOZv_sWtXDjEjoOcgqdxqXkaJ4WGekP9LNF6Ge18EUEWBFEOBot4DJKweIa1RpzwBG1wtZXD4vYZf6PaZfIptlrmdvLcxReW0LZJ3ZV39U_nD1417SrKhXjPQDTxUFttk_KCt-yEgnzNOxoqi3Y-UbwKE3o1oF93C3tlPdxS1B0OLgPz8iYYw9p3cBuMEQtCzG-jYXfP9c39KOtnXDF_HJw_q-NOUXYXZBxGL1UEywsA7kI0cg5ICL-kb6bEAOb59InChvEiYTu1gxxipFW0oq9b4duiQPNZMfufNGOi3MxNX6c15gB5oE_PWAnZIgV-O_m-6dnLhxSvDlOO2_a90TEd0Am45wm3wIHu4UX07QVthyGaTdTt5rNCp1RW1JmaFIhZWdvPDvaJ-TmdXsworj6TwgFjFbZgg0RaOWnZcTkDkpOFtQJxlaJSd-WvUnNQc09DYC4IUcUb_Npd5vU58tNBRPjYjHtgMCtjewTEM3ox5Zg7eprrvqTE6u81P1YkhGqRS8Nq-tvGuPA2FwfSyCAD4ctHOC7K-xm--nnq80OzokelWetJ6KG6TXoCqvMzH6ePvhkuM1EKAWunsTrxlD457ZNSsrkkL54iCGz_Nut6Rcx7kBXTMu4p6crRI-NZKycRSpom-nMZhVTN3_1Ww6paQ8-i0XRbqH4ZfQ_A60tg4mxSf8pBStTzVU4-trB3lxkDK1oZ6yLxfanza_sbFsQX8WJKuzFj2BUQ81xQahAgrnPB0DPh-jCO211M3nxuMkRtGsOoD8qgUpZKPH6AaXEA7j8eV-nvX8cUIHnkqHcaFmxDr7G85Mu1c8Kktr0LlcIBiZZZFdH0j3NAmfXDgNeGTRDBYwhib7m5qAipD-DnKebqnUDSGeL2MlcJv9USJ5-rFmO0sHBlFsr2KnbZtbZqBhlMmnvFko2Kpv-7aCxEwWjYaOeUSco7APj4QHBCWK3FSoFSP0JaUKRgEb6oK627mYdnj26mak_Eb99nj6-8SdUJCBHj3VH3k5trtvrJpEKBdLbBjWYce5dAMl_xGrCcHod2DDJQRyV1awlo0qVi1HaA36rff5ELtA9RkGCKRO2YjYhudwvMH5H4RElEOcOItPUvnsZ3en-n1hUXt44SV-6e-vRSC-1wQ0UK6uLq-8pjzvsi77vy7ET3Zbl7o0_ZgQoAgmgubQ55MfQP3_FD8wQa813j5710q_jqNfrBdyufFLC2dhud8ZFfNnYFQkc4R6CFUonSTIiTC1RuOqqPrrWJVlPgxlwQZdSnwsYL_Pj9as-YTAaGpvCIqWbR8VeSyo7gwQwhKFI62JUWNgxft78YzEWcyX5IVKg&sai=AMfl-YSs3jN-j5NCH3oDsG6SJtdKQLJYWKofPMeDfC4DE8LJiwcKIAYgoE7zFuPny_M2aYHapt_B6cd4dNmzGHzOAVO3KxaNUWRdUMeZaqyu6No5oOsEjWoG0tpFzFqv2QE7-MNlD2I-iBWcIfzfcwyhKT81TCuAeZLlILBOdppnTE3TwZ4AyunzZ6u80dFo0WQ1pmBZYhE4LrZWRjcAA2c7eoOu0fwHpFbYj42vnv2owd22-uwZ9DHJvoChOYRk-sjn-mxUJSSpPIkR8lkxIx9to19b_RRc09Q8hDjGmhsfcqNkJr2-LzvdjXZe2JiXWCFq-D65CtOZsHi_QNrRGb1-t0SiMs49RND1OU2l9fRMAhNJZkRoYvsdvR9BFjnewLw6DMNTiFYCz2uoFSSfpwPyAwjbLuMYJEsmqFbEYIpwW1uwbXcUV4pNeF1_2gqFk85Q9OuMQjSmKny4iAaFv7MmGHLG4dPfgZWStmm-F5250wdyGPyrpnynt3G0ynfk6GnY3t1s&sig=Cg0ArKJSzN_26pR9WCnuEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5kZQ&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=195&cbvp=1&cstd=193&cisv=r20231109.83936&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 18 Nov 2023 00:46:25 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 4C4A 38 KB
13 KB 17ms
8ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 122500
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 14:44:45 GMT
expires: Fri, 15 Nov 2024 14:44:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 1609 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ace5b9bf52f3c6d12f1ca2bab58f97d6dbe6eeced381ee9d1e05bf751f32568

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7399 42 B
64 B 65ms
47ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvXtba7G8Lo7dYukPl-SA0LPkmOtEvlXPdGFVlqGcFf9HfPnUscxgUCwaPJ8JAVVzzaL-25uANuf6wh7TGM5E98P77g5RsoOE0Bbf67OmAChwZTe9sV2yxDl447ps7qkPirMXAz-XVuaqA9&sai=AMfl-YRBBiRcbYyxN4O232FS96-Ogevnjrt2Znk0JRZf6mJnA-7unBMFTCtO92BLwgd2fET57r4DJ-Ko11mvYUuGjKgX6W2L11S7YN6DQ02YAZZZeEu_AXqxPk1w5SciLidxjGvdR3MAYgV-5y5DdLtqJKYih7LLmeIRZxqm&sig=Cg0ArKJSzHucHNPiJycWEAE&cid=CAQSTwDICaaNwklgWC2mvH0W-xzRE3vTSnsdLX6jcl-Fg6Ex875K_EK2iuqR1vbxp7--xiNqIl2VWUsWkIPWkPYXIwSagrj710DSY8JOebDKikwYAQ&id=lidar2&mcvt=1000&p=0,436,90,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2126799684&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700268384563&rpt=122&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012310301456000/ Frame 2626 196 KB
55 KB 13ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 02:37:57 GMT
age: 79708
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56081
x-xss-protection: 0
server: sffe
etag: "6a17d296884b026a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 02:37:57 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2626 15 KB
5 KB 15ms
9ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 14 Nov 2023 05:14:53 GMT
age: 329492
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0
server: sffe
etag: "0b7142e00666043e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 13 Nov 2024 05:14:53 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2626 95 KB
28 KB 16ms
10ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 03:53:12 GMT
age: 75193
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29077
x-xss-protection: 0
server: sffe
etag: "7b1f1965b6cd6fda"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 03:53:12 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2626 5 KB
2 KB 19ms
13ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 01:14:32 GMT
age: 84713
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5b0a82507b260c6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 01:14:32 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 2626 40 KB
13 KB 19ms
14ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 16 Nov 2023 14:54:32 GMT
age: 121913
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12952
x-xss-protection: 0
server: sffe
etag: "9817e561a46c70fa"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 15 Nov 2024 14:54:32 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2626 2 KB
2 KB 13ms
7ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 26909
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 18 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2626 295 B
319 B 13ms
8ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 11387
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 18 Nov 2023 21:36:38 GMT

GET
DATA 200
OK truncated
/ Frame 2626 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2041039b19a5c1469de7ae22fa8a0c38b76c992347466c673d1b92f7f5540318

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 2037923557963795609
tpc.googlesyndication.com/daca_images/simgad/ Frame 2626 111 KB
112 KB 16ms
15ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/2037923557963795609

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaf2cca604f954ea93606a6f4b85f09ba852f2a849dfe1fdc9acdb43548dfe15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 23:58:52 GMT
x-content-type-options: nosniff
age: 175653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 114155
x-xss-protection: 0
last-modified: Fri, 04 Aug 2023 14:26:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 14 Nov 2024 23:58:52 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2626 0
0 226ms
14ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTR3UNr3r__0nioUkrnYcx9sY2UtPvo4amRLsp41lulewCWZ4Zd49b70jUv9bv0xox5NkUQZ0u8uveH8NM-puzrgfKPJQ
Requested by: Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 8ec6d01d4e9945d2bd9b889183b426ec.js Show response
s0.2mdn.net/sadbundle/16803923726020142021/ Frame BFB2 132 KB
38 KB 7ms
7ms Script
application/x-javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/8ec6d01d4e9945d2bd9b889183b426ec.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bbfaaa6e8f59636633b8b0dba1bb295c95c8f73ac3795e3eccca66ce570d4ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:41:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38772
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:41:30 GMT

GET
H3 200 2037923557963795609
tpc.googlesyndication.com/daca_images/simgad/ Frame 2626 111 KB
112 KB 7ms
7ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/2037923557963795609

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eaf2cca604f954ea93606a6f4b85f09ba852f2a849dfe1fdc9acdb43548dfe15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 23:58:52 GMT
x-content-type-options: nosniff
age: 175653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 114155
x-xss-protection: 0
last-modified: Fri, 04 Aug 2023 14:26:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 14 Nov 2024 23:58:52 GMT

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2626 2 KB
2 KB 9ms
9ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 26909
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 18 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 2626 295 B
319 B 9ms
9ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 11387
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 18 Nov 2023 21:36:38 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C328 624 B
242 B 20ms
19ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIvrnPEBMAE&v=APEucNU28BtqJSc0kjiIgJzgCvt8k3LxXFUnIyMxb59MlI3S9xGP7TtYia55SV9UV2ClJKwBi5DOZ9GV8dv44mHPqjv-scG_IrO5xpQ9i4qIx5WzB-R8G3sCN12uUhK5vnmBk-CQog7KsIGqj1Wm9IO42BfxlOECAEneq0aATmi4ePrhaVaG-5g

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:26 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame DB9D 111 KB
39 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Origin: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 06:30:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65775
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 06:30:11 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame DB9D 7 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:55:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28228
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:55:58 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame DB9D 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14168
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 20:50:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame DB9D 41 KB
14 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 22:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6736
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 22:54:10 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame DB9D 3 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37052
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1F13 1 KB
643 B 7ms
6ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11373
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Sat, 18 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame DB9D 20 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55298
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DB9D 42 B
63 B 42ms
41ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AkSekSoh46ih6blDuCsgYrUCmBqLwb4ezAEWCJ1nwS33xOwwmFT6foW7mc_e6bcl2XIOqUr1aTJbEChXfNgtVohaqwjGyEhXK4SSkbNgcsQ57ZsqY

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame DB9D 0
0 16ms
14ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQp2QGjU3-nGgYFrq7YGLXOwXpM3Ev-Rrp8BCF4M9TpDvho8g53KjDLDutyvRqn6G2_5uoVfRO8bWl719eSF_Yw1wVRvw
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame DB9D 202 KB
64 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:26 GMT

GET
H3

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame 2626
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
0

16ms
15ms

Image
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by: Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/
Protocol: H3
Server: 2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Redirect headers

date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C328
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

43 B
739 B

20ms
20ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIvrnPEBMAE&v=APEucNU28BtqJSc0kjiIgJzgCvt8k3LxXFUnIyMxb59MlI3S9xGP7TtYia55SV9UV2ClJKwBi5DOZ9GV8dv44mHPqjv-scG_IrO5xpQ9i4qIx5WzB-R8G3sCN12uUhK5vnmBk-CQog7KsIGqj1Wm9IO42BfxlOECAEneq0aATmi4ePrhaVaG-5g
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VQqCjm%2F%2BS3oZum1tNSYGf83tYpiUyyrpD9%2Fni9RGkT7WSK1J4FSB1Ue8t1oTtUdEpBMhpb%2FmdjF0iNUKMQFVhq%2Bv3gRFng3VlR%2FwCtK32%2FyuIWVfU3A%2FJztqgJz6jhtzfzLzV4JCiSontw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 827c3244ce09bb5f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C328
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVgJYJJiT797tUzxZASq5gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1

43 B
732 B

30ms
30ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIvrnPEBMAE&v=APEucNU28BtqJSc0kjiIgJzgCvt8k3LxXFUnIyMxb59MlI3S9xGP7TtYia55SV9UV2ClJKwBi5DOZ9GV8dv44mHPqjv-scG_IrO5xpQ9i4qIx5WzB-R8G3sCN12uUhK5vnmBk-CQog7KsIGqj1Wm9IO42BfxlOECAEneq0aATmi4ePrhaVaG-5g
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x0pPdphbewfLfJFSYyLBnqDQAAnX3oBGnKcW4t7eCQwwZnynDXbN623liyc%2FYuyfkOxMNflYY20ZTTCDa7FQsaYeQE6eubXNBIbdRVgISGEbJVGs9UsX03AwbmjBoloP5q499UyTuNQw%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 827c3244ee1dbb5f-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBgLLIhF04hhtJjR2lWyi0E&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C328
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1

43 B
843 B

7ms
6ms

Image
image/gif

37.252.171.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIvrnPEBMAE&v=APEucNU28BtqJSc0kjiIgJzgCvt8k3LxXFUnIyMxb59MlI3S9xGP7TtYia55SV9UV2ClJKwBi5DOZ9GV8dv44mHPqjv-scG_IrO5xpQ9i4qIx5WzB-R8G3sCN12uUhK5vnmBk-CQog7KsIGqj1Wm9IO42BfxlOECAEneq0aATmi4ePrhaVaG-5g

Protocol

Server

37.252.171.52 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
an-x-request-uuid: 8b10b6e8-19a2-49eb-be54-28aaa351fe83
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 80.255.10.198; 80.255.10.198; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPbfB8Y4OQreoVzIQNt0aaM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C328
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

170 B
188 B

17ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D

Requested by

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
an-x-request-uuid: cfe947b4-3776-4be2-b349-fae2e4ef852c
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D
x-proxy-origin: 80.255.10.198; 80.255.10.198; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C4A 39 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27408
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 1F13
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESECw6DTn4_rDE1QU7GSB6NLA&google_cver=1&google_push=AXcoOmRKqWe-ZyoWISvXzTr5VP9S3hbQSmhPbA8ysGmEwbrzrOJqne_xE6_g0ygOqzapYE7VUWZV_Xi3F9d3YEPTIdvOvAxAu-6Vcg
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjMzODU2NjgzNjk0OTA2OTA3OA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECw6DTn4_rDE1QU7GSB6NLA&google_cver=1

43 B
398 B

53ms
14ms

Image
image/gif

46.228.164.11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECw6DTn4_rDE1QU7GSB6NLA&google_cver=1
Protocol: H2
Server: 46.228.164.11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESECw6DTn4_rDE1QU7GSB6NLA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F13
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aVh1aVBpWWQxUjQ5dEU1&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&google_cver=1&google_push=AXcoOmR8-tJCuhaepiy6nVs_cftdOPhTUSwW88Pxr7JZqjE...

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aVh1aVBpWWQxUjQ5dEU1&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&google_cver=1&google_push=AXcoOmR8-tJCuhaepiy6nVs_cftdOPhTUSwW88Pxr7JZqjE5sNFhQLlAJnEGHFFu50R3pslt51H85vXoukyr62vix08vm75f33YZhQ

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 18 Nov 2023 00:46:25 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aVh1aVBpWWQxUjQ5dEU1&google_gid=CAESEDKqzie8cKpbs_igmbVKeqY&google_cver=1&google_push=AXcoOmR8-tJCuhaepiy6nVs_cftdOPhTUSwW88Pxr7JZqjE5sNFhQLlAJnEGHFFu50R3pslt51H85vXoukyr62vix08vm75f33YZhQ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 1F13 43 B
245 B 52ms
14ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEENvyo8eI2GSe3gHf3B8I_U&google_cver=1&google_push=AXcoOmS6rncauVBJRk23EmwY9urg0TVmE1AtgRK7kYsh6E2nEo6n_j6f-BfPrVByoC_ohRY99jVRcjD7B6Xw9a2PACGdQ8B1_6CF3w
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H2 204 -
s.ad.smaato.net/c/n/// Frame 1F13 0
237 B 49ms
20ms Image
text/plain 2600:9000:211e:3a00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEB1XZKbt-fts9lLPLSbEoOI&google_cver=1&google_push=AXcoOmQvmhHKwhCGjIA8ryaC0W8-p_UM0VdnoQqzg9hMQRrC5pquwl6u9BXWR0L-GpEcCLMTqW9iOhSC458MiS0yMz95lKWy17l9FQ
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:3a00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
cache-control: no-cache, must-revalidate
via: 1.1 9928105291571d6cae52bcb916c898d8.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: LAFQYOuEHpT9bcr5eDpFauyt90gXhW_LdgT7mIovdgL5K1-CPVDwCg==
x-cache: Miss from cloudfront

GET
H2

200

report
sync.teads.tv/um/ Frame 1F13
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEJWq069w0xRj...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=AXcoOmSF0obw6m4VNHwLB1V68h0_k6j8fS3yc2guIV7D-EriSXSt23CbCF1mISM7s2mVYjXLqkutqhT0KyvKSfKXi5X6G-vw7jlGgEI
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

37ms
37ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Sat, 18 Nov 2023 00:46:26 GMT
pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F13
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEEk2GGCXfEdF6R-VQSRKF8I&google_cver=1&google_push=AXcoOmSIjaOaC14cq...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D&google_gid=CAESEEk2GGCXfEdF6R-VQSRKF8I&google_cver=1&google_push=AXcoOmSIjaOaC14cqKLEwAk47ODvvpppoL...

170 B
188 B

19ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D&google_gid=CAESEEk2GGCXfEdF6R-VQSRKF8I&google_cver=1&google_push=AXcoOmSIjaOaC14cqKLEwAk47ODvvpppoLtEyoWGjx3HUEf4Ip6KCRObwU74IJn0pTSNRxk3wCg4fHueJvz1QVG8MovHZcCKjpnHSjo

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
an-x-request-uuid: cefe458c-1dcf-44d2-a658-bcc3a4d01398
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjYxOTQzNDM2Njk2MzAyMzQyMA%3D%3D&google_gid=CAESEEk2GGCXfEdF6R-VQSRKF8I&google_cver=1&google_push=AXcoOmSIjaOaC14cqKLEwAk47ODvvpppoLtEyoWGjx3HUEf4Ip6KCRObwU74IJn0pTSNRxk3wCg4fHueJvz1QVG8MovHZcCKjpnHSjo
x-proxy-origin: 80.255.10.198; 80.255.10.198; 1005.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1F13
Redirect Chain

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_...
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=4bc4f3dd-8841-43c3-9be6-eea352f97f39&google_cver=1&google_gid=CAESEOp3WrUq2qK6LbJpk4OLNhU&gdpr_consent=${GDPR_CONSENT_109}&google_...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=4bc4f3dd-8841-43c3-9be6-eea352f97f39&google_cver=1&google_gid=CAESEOp3WrUq2qK6LbJpk4OLNhU&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmRTiZG16ZNNmDIJ9VwizD9LAhWHp6h1uFvXM3MgtPflsFBaQtM5qPWtOfkmb1_jytnqej4B-owDPPm66K0262IfKs06EiNdX0A&gdpr=${GDPR}

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=4bc4f3dd-8841-43c3-9be6-eea352f97f39&google_cver=1&google_gid=CAESEOp3WrUq2qK6LbJpk4OLNhU&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmRTiZG16ZNNmDIJ9VwizD9LAhWHp6h1uFvXM3MgtPflsFBaQtM5qPWtOfkmb1_jytnqej4B-owDPPm66K0262IfKs06EiNdX0A&gdpr=${GDPR}
date: Sat, 18 Nov 2023 00:46:26 GMT
server: _
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1F13 0
12 B 15ms
14ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JRkMe3KsOSn2EAnyDSyAsv-7jWcTwGhMG_R-CY035895CDDai3Hen8JGaRfIeueAswBx6mfVxi

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17804274672963380998/ Frame 9920 15 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eab2091e72288a7fcf3235bd978b63d33900194440c455ea2769628da948c6b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 82456
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3501
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 01:52:10 GMT
expires: Sat, 16 Nov 2024 01:52:10 GMT
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame DB9D 0
0 53ms
53ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuUhryRPHc4MTGEshU7Rx8g6RqLglyg7YFQeYoXwylwz8JffUifUEqEEugqV35RGVkSryWTrt7ABBYHnPiAZddJI_qJW8C4xCEb-1hkeyxlUR__gHdjbog3wU2gLgT7_dt6U6JiTKlp7_aRQiksM425Jh-zkSzKFtJ1QGkSxBIfRJ3GihRxoT1DUGqLwqNcB98sfHz2p3aX2kkFMLu0zKsZPot0300JDgVUmgxN_61HHPBw4EoIkJ6esRe_UKJfmupfCNOgnGPzlN4eRBla-z43_WgH_C2l--miQcxvCoqV_UWpvN0urP0pxa5uZnrxjl02Fcm1ulqHJ17HoNOTVH_Pj5YlVZpJdTCz695o75o0KN104Im8fa9XnRUY-UcZWBQM64JdHL6qFyklWYPp_EPR6WGp8WBG1DgQ6CCFSKg4LOJgj7VZRhdJe2jFBv_sUwTZjT-_tIprP4NSGdaXvkJCCzw2RzY0pLl_mT1iwuKcqOoZhsTI8x7sLS8Q0mX2S5ib01TwX1ATgM6E2bp38JwEgbCLXExqG7FdPdwjmAjWdkIEo_PZriqAIziJnJSSzz5OY8mmoJGiABY-2Y45ek2HKkmrhQj3osAZizdk58rOCgeAPWuJH325CVB7DKHN79jEAjOgQxBAHEtki-lisJvDxvbd1D7UvBBv_9fzXZ4NI68Y0h9A_IKTuAdzE6ZMogJs-vL4kxj-A4uhjWJ9I8JZDIOmVGNVZSGVGmLfkOocnYkZp4xMK64S5ej5TrUne3Yu0HSWdWIJnabD-N5N_kq7YLz92XRfMz6RZ4_jo6X_6YCdM00WsL01Hr_U2vSSdtrKZEMDjcwD-pnjJxu1Z5Z8cbVHSekR78lMKMlx14d-UcpOjEkRCUstFiRg_eg8P9KulEzQ_id226tkFnpDT8igTJvqsQBkl_Fcw-Vnquycd1kojkniVsdvSqGBMimkJNYwDk5y25Ke5kzC626pOMFqBfujrP2vbXX_P59drn0lAGaoQ6jtLOwdGSRx00NsD-2MZgQSSj0t0Si1ykJ1q0JEHDBJ5xu5sjTIzli2vdMG4_I2e1EIZtzE7SGNILhUADNXwFZrqLF7BuOGceJh0SVkQlM1CpKoFgyQfGY-CUOCHGqAznEMQgyZaBuRqPpcvfKAHHtcF32zBAiGvy3kuLkWl4PaSJSF7rg40StFn0C29Rvph744eO1VngCEXX_VKLkgVbgnfrM9YAna4AMDdHXOt1Y3axCLF9erV4G87UPRO1pFx2-dd2JJJnufdinrTqvgHOSNUmgXmvV7Bj2uHJ5_dCFRwpJSQP-WN-5dnYngZDOSUCBZiP6eRfSsKBLdFcJ2JZ4mNmmUWkNwIPE-yfOxZrF49wKIhSu8euMTfqKmFQf0Q6Mb5IrX71HxjbL3ruDKEiIAptxaDV8a5hj7zjw4sA&sai=AMfl-YS_6bXREDNX6q4xIMSy1B9bYWRhzkbRTO4O0kxykl1GiFccGC_5s_WU14Nnv5ClCN2yQFVF-Zwm6bGRX3ZfTTJ9Xfw9g5hJ784XInr3q1PKIAkI3RmZTepKDW-ftz_zNpTy4cRdMhRNP-u2R1UeCwSYy37z_sVlTpiO6eHaL60D9kO-3w4ffA2YyuT4rcqV4u0qnVeWNSHtldl6cHvLJg18CtJX6XJ0MNuo9wsvW10C3GhP8ucJI-RrApy_towhy3lc0mJmNm5_SJZL6EgTMNUO4mltCBoYrM3-Pgdf1pf4aT2Dbal4FIrIfOaut_RoJbR8Zl1Z-xGTHu_T6vQy1r7G8w8PQv5VBZKWfgeeJSOSTgwihu6KuDkzuUMWS7KzvupJl4uTUcj8txTxPEds1wbWIIgsb2dbSpNBSdguTPTNl0xBqh9ab7M&sig=Cg0ArKJSzEmVzggbWfLyEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vYW5kYS5jb20&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=65&cbvp=1&cstd=63&cisv=r20231109.23305&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame BFB2 4 KB
632 B 21ms
20ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=IBM+Plex+Sans:600|IBM+Plex+Sans:700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16803923726020142021/8ec6d01d4e9945d2bd9b889183b426ec.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

892e60dbfc3ed039098df6041eae6e7ecc9401632e6692e709067f9dd8a8b7fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 18 Nov 2023 00:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 23:29:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Nov 2023 00:46:26 GMT

GET
H3 200 93248752bf3c6ae242fc38229c9b9821.png
s0.2mdn.net/sadbundle/16803923726020142021/media/ Frame BFB2 3 KB
3 KB 8ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/media/93248752bf3c6ae242fc38229c9b9821.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45b61408e1f1027e7f78dc1a5df291e0f5d1133d725d9d3b05c30c21e75555c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:41:31 GMT
x-content-type-options: nosniff
age: 32695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2865
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:41:31 GMT

GET
H3 200 6c3d82139d513f47caf965a94a07b1a7.png
s0.2mdn.net/sadbundle/16803923726020142021/media/ Frame BFB2 461 B
488 B 10ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/media/6c3d82139d513f47caf965a94a07b1a7.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54d2bf7a7c64822f0a37878124639151b927eb61771ab740932e682f26e4fd35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:41:31 GMT
x-content-type-options: nosniff
age: 32695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:41:31 GMT

GET
H3 200 59551b9fa92bc00b27606377b05a1ab4.svg
s0.2mdn.net/sadbundle/16803923726020142021/media/ Frame BFB2 2 KB
1006 B 9ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/media/59551b9fa92bc00b27606377b05a1ab4.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

495935f624a2d1ce73cadc4c9f75bf73b630ddfc6bff3b32143986c4d1ca9cb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:41:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 977
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:41:31 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 2626 0
0 52ms
52ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C_diGYQlYZduQGuWU7_UPyoqWsAzCxLywc9HxkoGVEvqytuqnPxABIN7BgJsBYJWqn4KwB6ABwun0xwPIAQKpAqwlHGtwSrI-4AIAqAMByAMIqgSIAk_QQ9pPq0t9vXnh1LI86cvDut9ejvUOer3kVlyGCB1FdU5Roow7N5j-dhhYEUtcL6N49Q0j-7p3wm3FYPZYkW0_0nDlDjCuOJ_L6EdN74567o7YpTUzLqA8-Zvrg4L_OJnGiNvjQ8bLlnMyn9fktfipuJ95_KJA6_WdZbujUb5SKTzGsEay2hs7ILd-bIsLyLGs0UEWEEPZBJLzx8gkL5OLZKnytqfVlIGy46B_5cQKxZHUneeNPhPvZ9ZLx54a1LU0mOV6UZ2ExJ_qN3IpS4wMMUDEBfQ6TWlwKZvYX59CPZH3eOXCl-tOUh7sDBPUrklBp-Cz7iRZu7GlSdeQvIP6GyfXXhwWosAE5pOn6cQE4AQBiAXF3b2NTKAGAoAHppaLOKgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEJ-4MNIIFgiA4YAQEAEYHTICqgI6AoBASL39wTqaCXNodHRwczovL3d3dy5lbXBhdGljYS5jb20vZW1icmFjZXBsdXMvP3V0bV9zb3VyY2U9R29vZ2xlJnV0bV9tZWRpdW09Z2RuJnV0bV9jYW1wYWlnbj1HRE5fQU9fSE1QUl9BV1ImdXRtX2NvbnRlbnQ9aHAxgAoDyAsBogwQKg4KDOS0sQLutbECtbixAuINEwjF3OOoqcyCAxVlyrsIHUqFBcbYEwPQFQGYFgGAFwGyFx8KHQgAEhRwdWItNzc4MDc1ODUzOTc1MTI0MxigqIsB&sigh=WxmxbXlhDcA&uach_m=[]&ase=2&nis=5&cid=CAQSPADICaaNo7Ywk0aFX-3kqrmZYn_DrykKqaXi4F3MrNBof8oE5Vvm6sEMZVreAW8jxVm3bRe9Yv4E2akhXRgB&cbvp=2
Requested by: Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5B49 38 KB
13 KB 12ms
10ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 122501
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 14:44:45 GMT
expires: Fri, 15 Nov 2024 14:44:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DB9D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 179799dd3df94951d7295fdd0bbb1b98a423154cefdd2b1b285b6b56ce9da7a9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 a4588566f70b181f9dc85d4d3c72eea4.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 3 KB
1 KB 8ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/a4588566f70b181f9dc85d4d3c72eea4.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ad9af62a18d9f2009b3e03f67fd3c405281eb3114af1bef16f93ce2201210eb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:17:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30563
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 16:17:03 GMT

GET
H3 200 190bd4e4f50bd948bb0b2fd5340d0e62.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 3 KB
1 KB 21ms
21ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/190bd4e4f50bd948bb0b2fd5340d0e62.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6391c24064671e12dd5bb677aad7675bc2541b8ff92717fa1fc1c0cd5ffb845b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 13:41:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 558304
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1215
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Nov 2024 13:41:22 GMT

GET
H3 200 a84be26f409975bd5cf078ce6d562f63.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 29 KB
7 KB 9ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/a84be26f409975bd5cf078ce6d562f63.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bdb5f218320f40b8e08d2eef06eb81fe802515a4603605baba644446779a1262

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 10:12:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 570835
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7644
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Nov 2024 10:12:31 GMT

GET
H3 200 625e87275000040d080b6ec2a07a47b6.png
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 50 KB
50 KB 10ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/625e87275000040d080b6ec2a07a47b6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14f4f917b58f69aef8732aaf4cb6055ad75722214fc867a7f576ec96abdac281

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:36:01 GMT
x-content-type-options: nosniff
age: 90625
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51395
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 23:36:01 GMT

GET
H3 200 0659d4f925f987cdfeaa4e851ae20f75.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 4 KB
1 KB 11ms
10ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/0659d4f925f987cdfeaa4e851ae20f75.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fe9f7c1bc8e29059f762c0eef6ee762af1fa468a5644ee9345e6cd06380320b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 10:12:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 570835
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1488
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 10 Nov 2024 10:12:31 GMT

GET
H3 200 645c9112293cfcbcd91e590d3473dcc4.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 3 KB
1 KB 11ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/645c9112293cfcbcd91e590d3473dcc4.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b26ac669eb1618766e1432f2c9c6603791c83b6e6e8073bf207011421d1e64f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:36:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90625
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1265
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 23:36:01 GMT

GET
H3 200 2482e1e80ebae1a4fd5b9edaa46e94ac.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 2 KB
1 KB 10ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/2482e1e80ebae1a4fd5b9edaa46e94ac.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5d4844e8e59a54167ca6d54fcdd5819c4399e23e98c1135373415c67a0e7842

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 05:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328985
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 994
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Nov 2024 05:23:21 GMT

GET
H3 200 714dd5c2992979624e58ccf7f2082d0e.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 165 B
187 B 9ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/714dd5c2992979624e58ccf7f2082d0e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ab84f06cdb5500ea115038beb904121ebc594ffbf4e1ab3ed4da78d33d3058f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 21:33:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270803
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 158
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Nov 2024 21:33:03 GMT

GET
H3 200 cfafc842087dc6d9e5ca5c02a2d17c14.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 147 B
175 B 8ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/cfafc842087dc6d9e5ca5c02a2d17c14.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f28cd41b36762b675496df038342f672a1820d8042e6476a848151920efac8cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 05:23:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328985
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 141
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Nov 2024 05:23:21 GMT

GET
H3 200 cfa6fe536fcb985e98a03ec8a37b4ef5.svg
s0.2mdn.net/sadbundle/17804274672963380998/images/ Frame 9920 274 B
232 B 9ms
8ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17804274672963380998/images/cfa6fe536fcb985e98a03ec8a37b4ef5.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20aa5d9a3e5828c560a2ff2996e9b63b1df8db4b99a9b87a08ce5254a2d82a14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17804274672963380998/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:36:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90625
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 197
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:06:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 23:36:01 GMT

GET
H3 200 zYX9KVElMYYaJe8bpLHnCwDKjQ76AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ Frame BFB2 20 KB
20 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjQ76AIFsdA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:600|IBM+Plex+Sans:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31535a91ce3f6b8ed3ddedadab1e49957e2220263a640df1a3f14f6fdfe15eb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 16:35:55 GMT
x-content-type-options: nosniff
age: 115831
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20356
x-xss-protection: 0
last-modified: Tue, 02 May 2023 16:19:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Nov 2024 16:35:55 GMT

GET
H3 200 zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2
fonts.gstatic.com/s/ibmplexsans/v19/ Frame BFB2 19 KB
19 KB 12ms
11ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ibmplexsans/v19/zYX9KVElMYYaJe8bpLHnCwDKjWr7AIFsdA.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=IBM+Plex+Sans:600|IBM+Plex+Sans:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 04:53:00 GMT
x-content-type-options: nosniff
age: 330806
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19440
x-xss-protection: 0
last-modified: Tue, 02 May 2023 16:08:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Nov 2024 04:53:00 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/ Frame 4826 1 KB
447 B 7ms
7ms Stylesheet
text/css 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f802f9dc3044e971e890fbdbfbdabf2dfeab99ec670d366f56f393826cdd1264

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:53:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31983
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 409
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:53:23 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame DB9D 0
0 45ms
44ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuUhryRPHc4MTGEshU7Rx8g6RqLglyg7YFQeYoXwylwz8JffUifUEqEEugqV35RGVkSryWTrt7ABBYHnPiAZddJI_qJW8C4xCEb-1hkeyxlUR__gHdjbog3wU2gLgT7_dt6U6JiTKlp7_aRQiksM425Jh-zkSzKFtJ1QGkSxBIfRJ3GihRxoT1DUGqLwqNcB98sfHz2p3aX2kkFMLu0zKsZPot0300JDgVUmgxN_61HHPBw4EoIkJ6esRe_UKJfmupfCNOgnGPzlN4eRBla-z43_WgH_C2l--miQcxvCoqV_UWpvN0urP0pxa5uZnrxjl02Fcm1ulqHJ17HoNOTVH_Pj5YlVZpJdTCz695o75o0KN104Im8fa9XnRUY-UcZWBQM64JdHL6qFyklWYPp_EPR6WGp8WBG1DgQ6CCFSKg4LOJgj7VZRhdJe2jFBv_sUwTZjT-_tIprP4NSGdaXvkJCCzw2RzY0pLl_mT1iwuKcqOoZhsTI8x7sLS8Q0mX2S5ib01TwX1ATgM6E2bp38JwEgbCLXExqG7FdPdwjmAjWdkIEo_PZriqAIziJnJSSzz5OY8mmoJGiABY-2Y45ek2HKkmrhQj3osAZizdk58rOCgeAPWuJH325CVB7DKHN79jEAjOgQxBAHEtki-lisJvDxvbd1D7UvBBv_9fzXZ4NI68Y0h9A_IKTuAdzE6ZMogJs-vL4kxj-A4uhjWJ9I8JZDIOmVGNVZSGVGmLfkOocnYkZp4xMK64S5ej5TrUne3Yu0HSWdWIJnabD-N5N_kq7YLz92XRfMz6RZ4_jo6X_6YCdM00WsL01Hr_U2vSSdtrKZEMDjcwD-pnjJxu1Z5Z8cbVHSekR78lMKMlx14d-UcpOjEkRCUstFiRg_eg8P9KulEzQ_id226tkFnpDT8igTJvqsQBkl_Fcw-Vnquycd1kojkniVsdvSqGBMimkJNYwDk5y25Ke5kzC626pOMFqBfujrP2vbXX_P59drn0lAGaoQ6jtLOwdGSRx00NsD-2MZgQSSj0t0Si1ykJ1q0JEHDBJ5xu5sjTIzli2vdMG4_I2e1EIZtzE7SGNILhUADNXwFZrqLF7BuOGceJh0SVkQlM1CpKoFgyQfGY-CUOCHGqAznEMQgyZaBuRqPpcvfKAHHtcF32zBAiGvy3kuLkWl4PaSJSF7rg40StFn0C29Rvph744eO1VngCEXX_VKLkgVbgnfrM9YAna4AMDdHXOt1Y3axCLF9erV4G87UPRO1pFx2-dd2JJJnufdinrTqvgHOSNUmgXmvV7Bj2uHJ5_dCFRwpJSQP-WN-5dnYngZDOSUCBZiP6eRfSsKBLdFcJ2JZ4mNmmUWkNwIPE-yfOxZrF49wKIhSu8euMTfqKmFQf0Q6Mb5IrX71HxjbL3ruDKEiIAptxaDV8a5hj7zjw4sA&sai=AMfl-YS_6bXREDNX6q4xIMSy1B9bYWRhzkbRTO4O0kxykl1GiFccGC_5s_WU14Nnv5ClCN2yQFVF-Zwm6bGRX3ZfTTJ9Xfw9g5hJ784XInr3q1PKIAkI3RmZTepKDW-ftz_zNpTy4cRdMhRNP-u2R1UeCwSYy37z_sVlTpiO6eHaL60D9kO-3w4ffA2YyuT4rcqV4u0qnVeWNSHtldl6cHvLJg18CtJX6XJ0MNuo9wsvW10C3GhP8ucJI-RrApy_towhy3lc0mJmNm5_SJZL6EgTMNUO4mltCBoYrM3-Pgdf1pf4aT2Dbal4FIrIfOaut_RoJbR8Zl1Z-xGTHu_T6vQy1r7G8w8PQv5VBZKWfgeeJSOSTgwihu6KuDkzuUMWS7KzvupJl4uTUcj8txTxPEds1wbWIIgsb2dbSpNBSdguTPTNl0xBqh9ab7M&sig=Cg0ArKJSzEmVzggbWfLyEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vYW5kYS5jb20&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=198&vt=11&dtpt=133&dett=3&cstd=63&cisv=r20231109.23305&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 1609 0
0 46ms
46ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsuTczNwJiLTOZv_sWtXDjEjoOcgqdxqXkaJ4WGekP9LNF6Ge18EUEWBFEOBot4DJKweIa1RpzwBG1wtZXD4vYZf6PaZfIptlrmdvLcxReW0LZJ3ZV39U_nD1417SrKhXjPQDTxUFttk_KCt-yEgnzNOxoqi3Y-UbwKE3o1oF93C3tlPdxS1B0OLgPz8iYYw9p3cBuMEQtCzG-jYXfP9c39KOtnXDF_HJw_q-NOUXYXZBxGL1UEywsA7kI0cg5ICL-kb6bEAOb59InChvEiYTu1gxxipFW0oq9b4duiQPNZMfufNGOi3MxNX6c15gB5oE_PWAnZIgV-O_m-6dnLhxSvDlOO2_a90TEd0Am45wm3wIHu4UX07QVthyGaTdTt5rNCp1RW1JmaFIhZWdvPDvaJ-TmdXsworj6TwgFjFbZgg0RaOWnZcTkDkpOFtQJxlaJSd-WvUnNQc09DYC4IUcUb_Npd5vU58tNBRPjYjHtgMCtjewTEM3ox5Zg7eprrvqTE6u81P1YkhGqRS8Nq-tvGuPA2FwfSyCAD4ctHOC7K-xm--nnq80OzokelWetJ6KG6TXoCqvMzH6ePvhkuM1EKAWunsTrxlD457ZNSsrkkL54iCGz_Nut6Rcx7kBXTMu4p6crRI-NZKycRSpom-nMZhVTN3_1Ww6paQ8-i0XRbqH4ZfQ_A60tg4mxSf8pBStTzVU4-trB3lxkDK1oZ6yLxfanza_sbFsQX8WJKuzFj2BUQ81xQahAgrnPB0DPh-jCO211M3nxuMkRtGsOoD8qgUpZKPH6AaXEA7j8eV-nvX8cUIHnkqHcaFmxDr7G85Mu1c8Kktr0LlcIBiZZZFdH0j3NAmfXDgNeGTRDBYwhib7m5qAipD-DnKebqnUDSGeL2MlcJv9USJ5-rFmO0sHBlFsr2KnbZtbZqBhlMmnvFko2Kpv-7aCxEwWjYaOeUSco7APj4QHBCWK3FSoFSP0JaUKRgEb6oK627mYdnj26mak_Eb99nj6-8SdUJCBHj3VH3k5trtvrJpEKBdLbBjWYce5dAMl_xGrCcHod2DDJQRyV1awlo0qVi1HaA36rff5ELtA9RkGCKRO2YjYhudwvMH5H4RElEOcOItPUvnsZ3en-n1hUXt44SV-6e-vRSC-1wQ0UK6uLq-8pjzvsi77vy7ET3Zbl7o0_ZgQoAgmgubQ55MfQP3_FD8wQa813j5710q_jqNfrBdyufFLC2dhud8ZFfNnYFQkc4R6CFUonSTIiTC1RuOqqPrrWJVlPgxlwQZdSnwsYL_Pj9as-YTAaGpvCIqWbR8VeSyo7gwQwhKFI62JUWNgxft78YzEWcyX5IVKg&sai=AMfl-YSs3jN-j5NCH3oDsG6SJtdKQLJYWKofPMeDfC4DE8LJiwcKIAYgoE7zFuPny_M2aYHapt_B6cd4dNmzGHzOAVO3KxaNUWRdUMeZaqyu6No5oOsEjWoG0tpFzFqv2QE7-MNlD2I-iBWcIfzfcwyhKT81TCuAeZLlILBOdppnTE3TwZ4AyunzZ6u80dFo0WQ1pmBZYhE4LrZWRjcAA2c7eoOu0fwHpFbYj42vnv2owd22-uwZ9DHJvoChOYRk-sjn-mxUJSSpPIkR8lkxIx9to19b_RRc09Q8hDjGmhsfcqNkJr2-LzvdjXZe2JiXWCFq-D65CtOZsHi_QNrRGb1-t0SiMs49RND1OU2l9fRMAhNJZkRoYvsdvR9BFjnewLw6DMNTiFYCz2uoFSSfpwPyAwjbLuMYJEsmqFbEYIpwW1uwbXcUV4pNeF1_2gqFk85Q9OuMQjSmKny4iAaFv7MmGHLG4dPfgZWStmm-F5250wdyGPyrpnynt3G0ynfk6GnY3t1s&sig=Cg0ArKJSzN_26pR9WCnuEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9iaXRkZWZlbmRlci5kZQ&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=801&vt=11&dtpt=606&dett=3&cstd=193&cisv=r20231109.83936&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 23ms
23ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202311090101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d546c9fada91058c2d7037d2c7d786565783b40b49c7956bc812b1c63c5eaf18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12293
x-xss-protection: 0

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 5B49 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27408
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H3 200 59551b9fa92bc00b27606377b05a1ab4.svg
s0.2mdn.net/sadbundle/16803923726020142021/media/ Frame BFB2 2 KB
1006 B 10ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/media/59551b9fa92bc00b27606377b05a1ab4.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/16803923726020142021/8ec6d01d4e9945d2bd9b889183b426ec.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

495935f624a2d1ce73cadc4c9f75bf73b630ddfc6bff3b32143986c4d1ca9cb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:41:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 32695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 977
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:41:31 GMT

GET
H3 200 txt2.png
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 7 KB
8 KB 10ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/txt2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32b1c3112d7f0bf7b2390f8947f9db048208e8c46fb2226e1d14e82da8781ee8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 23:43:55 GMT
x-content-type-options: nosniff
age: 349351
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7674
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Nov 2024 23:43:55 GMT

GET
H3 200 txt3.png
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 9 KB
9 KB 13ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/txt3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5edfd4d63a63f0e73e5e233040b1916c3398c798742c06d7522afa27c29c1ceb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:53:22 GMT
x-content-type-options: nosniff
age: 31984
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9598
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:53:22 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 705 B
741 B 13ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22c878a4e61529c23facfd4f611fa0c05f188b4da49e79004934ace9f802680d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:53:22 GMT
x-content-type-options: nosniff
age: 31984
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 705
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:53:22 GMT

GET
H3 200 fussnote.png
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 2 KB
2 KB 12ms
10ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/fussnote.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7e2f7e6132fd1fcffd09eea9041f2bbd74feea33743c80b4fcaa27415b88eea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 03:55:55 GMT
x-content-type-options: nosniff
age: 420631
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2199
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Nov 2024 03:55:55 GMT

GET
H3 200 logo2.svg
s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/ Frame 4826 2 KB
1 KB 11ms
10ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/img/logo2.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88588830962cdb62afa928436cb3c7aa7a571cef13c2cae0b3f3b014f3d1c0fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12654012590615468820/1-IEU-KONA_EV_Q3_23-Leaderboard-728x90-SEE_V2/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 03:55:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 420631
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1011
x-xss-protection: 0
last-modified: Tue, 19 Sep 2023 13:05:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Nov 2024 03:55:55 GMT

GET
H3 200 93248752bf3c6ae242fc38229c9b9821.png
s0.2mdn.net/sadbundle/16803923726020142021/media/ Frame BFB2 3 KB
3 KB 10ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/media/93248752bf3c6ae242fc38229c9b9821.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45b61408e1f1027e7f78dc1a5df291e0f5d1133d725d9d3b05c30c21e75555c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:41:31 GMT
x-content-type-options: nosniff
age: 32695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2865
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:41:31 GMT

GET
H3 200 6c3d82139d513f47caf965a94a07b1a7.png
s0.2mdn.net/sadbundle/16803923726020142021/media/ Frame BFB2 461 B
488 B 10ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/16803923726020142021/media/6c3d82139d513f47caf965a94a07b1a7.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54d2bf7a7c64822f0a37878124639151b927eb61771ab740932e682f26e4fd35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/16803923726020142021/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 15:41:31 GMT
x-content-type-options: nosniff
age: 32695
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 461
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 15:35:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 15:41:31 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4C4A 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B7egvYAlYZfnVMtbC7_UPg9GY4AEAAAAAOAHgBAI&bg=!0tGl0Z7NAAZxrfrxUa07ADQBe5WfOBpcvriwZEOciVxyun8YhO3TFiTu6yAuri4lDNXlYoOWdGJSF7WSsNTRaH1ImBsBAgAAAJVSAAAAAmgBBwoALvq_lawTwe79KK9zTnZXDUp6dBtH2jPZJ13nsQGbczykhrPtvXVW8CITyO01p-6ZAwJPpEb7hDEByDdoVDtmF5RXhC-JrwlVxeARLELa48GUjyfEkHdNXitrIAfru0LEr4FN5V2M2wX9_DjbCs4QAlHY8oKsJVsTfJ1IPOiY0MFy9yIl-cvczxeUd1QuPL_N_OcDgZr4nnh5HTEZ2dGcPF8jhDrWA1-TsYmXM4QaTIhVvLcVQ8SIyVnuqnJSKhoR-NVsMFCki2VZ86EZQDHXb7i7WAkYg6vDsyhhjFmMzMU0s-REmAfTDyPwyXILTg8OHoaQZJPO21FlHgsYKuiX3vBqyJ3t4zTbLrK-DCgGlpAVHdM6-BYcsDC6LZtaR1BZ5R7PX82e7XU215Z5qGrp4IRfTxtnXw2iDGQrFrZMHoGegbqFtFQ6OOMgweP5ceoUdcP4NuTspTerubW1lPk2iTRDx6O4N7JO4q_m98dNIhgWu9fCdzCnCm9-oueEwI04KVw1NsQCCSk8WyK0jZGou8HnrDkinFp5zqchg0Nz7lSyTlDlEV-BQwpkLvmzSM84rYDKYr9CVNkJ08SuulzlyFIZ1lSOPCyksv2dAHINvG4HXkB7X9lVf06Paq-wAqOZ0NRAoWd64j2J_EIinWEuIPJc5rWoxUbQyGU2SK18NZ9NRN8-iCCe3eZ3d3B0ox16NQOoW0zT2rHaIUuD8Gnv20a-BVQPdEcLDD20pANUejJJtO7SWSZhZfQkJawJopwBxjHglbNAN77_SMcF4R8lD1e77KAaxIw9IqeWCxm-C_BN5Bdhq7-Rwzj2qkKep57H70EMcPfLA-miibCprDOjJ8k2K0ZcBGUV9zi7EYUAgeTWouunYsyn2BZy4irmecjVfcUamRmu1Prctoc51zOquRO5HdltbWDYygE3rfug-X6TXvNbEWuew5fgqgyjNsVCEYL8jubxfAjz7OrkxWMVxvHZmIm0ROjftquKgm3tLjXPO4TqXs0Hz-mhdTD1IY9vvn7PGqxS2sseov3WjXT2I9CJ6qdR9cy6pgGiJ2bD4KTgzyIo429uH5hMmVfiu7SNfwqmEA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 419 KB
103 KB 483ms
482ms Fetch
text/plain 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=207926523343629&correlator=1121452476133636&eid=31079657%2C31079525%2C21065725&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22809522745%2Cforex.alghtas.xyz_stickyy1%2Cforex.alghtas.xyz_stickyy2%2Cforex.alghtas.xyz_PUSHhh%2Cforex.alghtas.xyz_one%2Cforex.alghtas.xyz_five&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=300x100%7C300x50%7C120x30%7C320x100%7C300x75%7C320x50%7C970x90%7C216x54%7C728x90%2C728x90%7C300x75%7C216x54%7C970x90%7C120x30%7C300x100%7C320x50%7C300x50%7C320x100%2C120x20%7C120x60%7C300x100%7C120x30%7C300x50%7C320x100%7C320x50%7C300x75%7C320x75%2C320x50%7C250x250%7C250x360%7C320x480%7C480x320%2C320x480%7C480x320%7C250x250%7C250x360%7C320x50&ifi=7&sfv=1-0-40&rcs=1%2C1%2C1%2C1%2C1&eri=5&sc=1&cookie=ID%3D59381e6acceb571c%3AT%3D1700268383%3ART%3D1700268383%3AS%3DALNI_MZTcP2U25ur0RH7QPEEYgBFKiT-3w&gpic=UID%3D00000ccb7abc4673%3AT%3D1700268383%3ART%3D1700268383%3AS%3DALNI_MYWLudS9QetrBpRiRXYCjyUPJAXHw&abxe=1&dt=1700268386462&adxs=436%2C315%2C1280%2C1066%2C234&adys=0%2C1100%2C80%2C59%2C1443&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C0%7C2&ucis=2%7C3%7C4%7C5%7C6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fforex.alghtas.xyz%2F&vis=1&psz=728x-1%7C970x-1%7C300x-1%7C738x250%7C1132x480&msz=728x-1%7C970x-1%7C300x-1%7C738x250%7C1132x480&fws=512%2C512%2C512%2C0%2C0&ohw=0%2C0%2C0%2C0%2C0&ga_vid=2034059020.1700268384&ga_sid=1700268384&ga_hid=399945119&ga_fc=false&dlt=1700268383548&idt=165&adks=2126799684%2C3658310432%2C4130203354%2C368548625%2C26213238&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

14e257ca5b2db4666c6edba66b8154bb3128176262d5cf1ad9bb5f782e08b55c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 105297
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://forex.alghtas.xyz
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 62ms
62ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 00:46:26 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame FA04 42 B
64 B 47ms
47ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss-CRxCg8HOi3E4QwF7a_CU1a00FigbCEnoZqdafC5D-xnNRt4fUBoQNn01TxaWmwVQrLwLKFntyT46oC5uQ7uVBb2yORNaGMxqocqyNGSwCoJg9KJWiFPZxsuMpN3nsyoydeQ0-Y4KLVDq&sai=AMfl-YQ6gS3W0Cnyc3CzadWWAgJ3rb-LGJFgTyFdrKXmfbgfI-UNDRIeh-nhQFP_864gz3nyJWFE7hUyJIYQ0yFp3__18YnePbEcdmNuRWU2HIUmureaYYoThXJYmBtuwFPyO9Qi9t8AA792AqHI7VXc&sig=Cg0ArKJSzBF8wL8xaoU2EAE&cid=CAQSTgDICaaN28IgB7EPAYGk5iPJNvRl0qyE05-HQ_F0pczeCYQ0NpGHGr_yc0eGD50GV6CuQs8BIhNiJeW0WOi1P2i5Z85w7HFvZwTnuDVYaxgB&id=ampim&o=315,1100&d=970,100&ss=1600,1200&bs=1600,1200&mcvt=1012&mtos=0,0,1012,1012,1012&tos=0,0,1012,0,0&tfs=658&tls=1670&g=100&h=100&tt=1670&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1609 42 B
64 B 48ms
48ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv2KXqMSWRtPtdhpRpvVkkRhaDCkWUU6vnkFTLAxFeQXFDIH_Ghy7_H2qdje1WQdT-YXm0WAVWRDKm-rpO8tNZ3yUDcc9umzi1aoeqJr1ipeyfdFftI9SFVnkaB7TtY-X6_jLY-_5IRI_XD&sai=AMfl-YQK6Il7nSMOCQzeTMJPzBs9VLd-rvZRGf1rNn9VWwKUXNYR8pSXb02olEafSu9eV-7Pzxbw5ihWYOStQusqT8dlGPDZ0aoUIc-SXCMkDQGA9q-HHEjLezaUMSg4j4h5pAvQ2itep3Ykorq4fK2i&sig=Cg0ArKJSzM5uOMyNXu7uEAE&cid=CAQSTgDICaaND4p2zCtTNXpEmfuyQdtYVKqW84vk_iK4KkU9PshWRrvcGTHNF6ryB0cDUsnVwqR_DHCCL582vCveKN7PiTMqJiBbG8eZE_QPVhgB&id=lidar2&mcvt=1001&p=80,1280,130,1600&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4130203354&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700268385270&rpt=362&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 0DAC 13 KB
5 KB 7ms
6ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 35382
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 14:56:44 GMT
expires: Sat, 16 Nov 2024 14:56:44 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E481 829 B
558 B 18ms
17ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f53d596cc08d060c93833415f3af4a3e92822a807475d6f8501053c1ea105975

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NwinH2sEvasvT5jgzEbW-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-NwinH2sEvasvT5jgzEbW-A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:26 GMT
expires: Sat, 18 Nov 2023 00:46:26 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 0DAC 39 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27408
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E481 0
0 41ms
41ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202311090101&jk=207926523343629&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5B49 0
20 B 43ms
43ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BgolbYQlYZeL_Bu2B7_UPrbiSuAUAAAAAOAHgBAI&bg=!cXKlcj3NAAZxrfrxUa07ADQBe5WfOFb9f0LRoJAyO7er0Zil7H9La4PAKOgkhog6wqseWfLhwS7dEnAXajaSUGL7ASvQAgAAAHxSAAAAA2gBB5kDClgVGKYVCtQgJ105AOse514afeRqpm1dXkWroeXeqQILsSJWY6oBgPlfsl1ioW8fS7WNfJu8czht4QV9idIrDb-ryjuGWvlyTPj6Dlmvq92jVCdGK4Xg-D7RBWX9y45ZSoO6MzycZaNEq-g7FniMuQH-ESO-ur5JXaPvNpmmamcJcn7KV0JtJVYEwUw4rNL4fGpVytauavUtUx1PIxKd18mV_yzPk7SYjxTcXOIQM1PDPKB4jaJznhjVzTO_CciAr6Qadr9xG0hKQu5S_b4mQWGptiWef_y_x5bJZajZk8fZLv-xsY-m6uQseOX9O9IOS19Hvq5LUuOj7zb-bUcdk4FctoSe8Nf5E4_YVZBsQQ9mfrDsGEITYyFGh_GZnW9YcSxNKgUSwEzjMq71bqAzzxSsFOjtVvqDY85ZkwVkPMkYopXOcTN2LmMkRF5SS5r3DyUqB2Vn60h0F66yvK1yLg5tcPdWfMIWebVWBL6K5VDxgOuwYQFudu7tBrrPC_NguBkULg5dzgFbWhSzEOWt0FWKlGmcNbppKxDbHXFvg7GYLAGjvnBEsK73OD5U8dteIRxa97IuBjOwhoL12riaY6dK_voH3_d7m-hCW7M4TWgfsK_rsB4zjwd-e5zvTYBSFdJOJKpKBBm5TFqKtycDL2PAzUTwShthDNQfvnVz-Q9_d3B1vl3o9ZV0V7N0VBXq0PsEUGFOsv-klBAWX3M55D1D6PesmogPRTCF_rK8zAH6RXCBUr-5RtinrnqjFQN-nYTK3oCIc9VW_TCocZiAFE4jgWZ5Ko6WQ4eORMtnKNrEBcKCfJM5GwgunAFnPr33YuN3n0qxiyMk9rGJzZkub6ddwk6C6ezsZGJFysN-ygeW5ST4ZhvFrXlhWZbJQF3j2ThzasuLudh2MWEuauUcMVhOGW5MWwIlHNZuwxfLH_O2P9prhrv9HPByh65_Q2UAoInpYxaPHkHPLAU53gLKDCWQlVexbKp-OpteMI8gQOMiK4ZzltMfjybU5FX8et2cI1plvrfDNXPpHgo

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:26 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 0DAC 0
11 B 7ms
6ms Image
text/plain 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?IxctQw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 7399 0
0

GET dc_oe=ChMIiIq8qKnMggMVTfK7CB3_aAFbEAEYACDy4_Fe;met=1;&timestamp=1700268386957;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=1;
ade.googlesyndication.com/ddm/activity/ Frame 7399 0
0

POST event.png
tpsc-ew1.doubleverify.com/ Frame AC02 0
0

GET
H3 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1514 6 KB
3 KB 9ms
8ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET dc_oe=ChMI-YXnqKnMggMVVuG7CB2DKAYcEAEYACC5kINi;met=1;&timestamp=1700268386992;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;
ade.googlesyndication.com/ddm/activity/ Frame 1609 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 1609 0
0

GET dc_oe=ChMIorT4qKnMggMV7cC7CB0tnARXEAEYACC5iY1d;met=1;&timestamp=1700268386997;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;
ade.googlesyndication.com/ddm/activity/ Frame DB9D 0
0

GET activeview
pagead2.googlesyndication.com/pcs/ Frame DB9D 0
0

GET
H3 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame AA6B 6 KB
3 KB 12ms
9ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 24AB 6 KB
3 KB 9ms
7ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012310301456000/ Frame 8E28 196 KB
55 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 02:37:57 GMT
age: 79710
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56081
x-xss-protection: 0
server: sffe
etag: "6a17d296884b026a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 02:37:57 GMT

GET
H3 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 8E28 15 KB
5 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 14 Nov 2023 05:14:53 GMT
age: 329494
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5225
x-xss-protection: 0
server: sffe
etag: "0b7142e00666043e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 13 Nov 2024 05:14:53 GMT

GET
H3 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 8E28 95 KB
28 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 03:53:12 GMT
age: 75195
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29077
x-xss-protection: 0
server: sffe
etag: "7b1f1965b6cd6fda"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 03:53:12 GMT

GET
H3 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 8E28 5 KB
2 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 Nov 2023 01:14:32 GMT
age: 84715
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1911
x-xss-protection: 0
server: sffe
etag: "5b0a82507b260c6e"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sat, 16 Nov 2024 01:14:32 GMT

GET
H3 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012310301456000/v0/ Frame 8E28 40 KB
13 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012310301456000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 16 Nov 2023 14:54:32 GMT
age: 121915
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12952
x-xss-protection: 0
server: sffe
etag: "9817e561a46c70fa"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Fri, 15 Nov 2024 14:54:32 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 8E28 14 KB
1 KB 21ms
20ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 Nov 2023 23:31:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H3 200 container.html Show response
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame BF46 6 KB
3 KB 9ms
8ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js?cb=31079657

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://forex.alghtas.xyz/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:23 GMT
expires: Sun, 17 Nov 2024 00:46:23 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E28 2 KB
2 KB 14ms
13ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 26911
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 18 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E28 295 B
327 B 14ms
13ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 11389
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 18 Nov 2023 21:36:38 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 8E28 0
0 55ms
54ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CKLXnYglYZennHqiR7_UPjtOgmAHCjcv9c7jcyYPJENrZHhABIN7BgJsBYJWqn4KwB6AB6fSLvwPIAQGpAqwlHGtwSrI-4AIAqAMByAMKqgSLAk_QgSMyky-ArHr2Xo-6YNqAz81GD-uu79Y2jfvm-cPUPdS4AdPB-evCyfYA9JcehIihPlddpTj_m1NSzRzH7qaPqvoZw-6zkO5BxYneqPdSrI3B46ZWhiKYylyG1lIjpIFxfPw1rMHWCrzpG8ESG0tbU2F8pdzW4dSAYiJvUrvhbvUFaxmuVxWdPIgIAAx_fiVsz2o0UY7KSHN162-fNGwWeJtox0I-H_vTrNaC0EJEwH0Rm1XRrta0KarDuzCQwGdThCwN7XRaFJcdGYfLdoVRN1RKwsQdGu3EYojoWn1W6El3kHKb1FpON_rxMIwEQnMz0P78ZsCQTaptIBoJnObySNGhf2bqtW79YMAE9b7J1_8D4AQBiAWwx--9KZIFBAgEGAGSBQQIBRgEgAfFpYNCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ_9Aw0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOpoJ2wFodHRwczovL3d3dy5vdmhjbG91ZC5jb20vZGUvYmFyZS1tZXRhbC9hZHZhbmNlLz9hdF9tZWRpdW09ZGlzcGxheSZhdF9wbGF0Zm9ybT1nb29nbGUmYXRfY2FtcGFpZ249QWRXb3JkcyZhdF9jcmVhdGlvbj1pbnRfb3ZoX2RlX2RpX2Nsb3VkX2JhcmVtZXRhbF9vZmZlbnNpdmVfYWx3YXlzb24oYWR2YW5jZSkmYXRfdmFyaWFudD02MTA3MzI4NTIzMTkmYXRfZGV0YWlsX3BsYWNlbWVudD2ACgPICwGiDBgqFgoU5LSxAu61sQK1uLEC5LSxAu61sQLiDRMI2ZnMqanMggMVqMi7CB2OKQgT2BMKiBQB0BUBgBcBshcfCh0IABIUcHViLTc3ODA3NTg1Mzk3NTEyNDMYoKiLAQ&sigh=jIXYtZhgGmU&uach_m=[UACH]&ase=2&nis=ATTRIBUTION_REPORTING_STATUS&cid=CAQSOwDICaaNquZZdzR9uyZZ7qWCDyS1972aSA7QWWQlDrqA_wJZcmZxOR9qBzcIw9nwCsfd0dgx2fw0FcnRGAE&template_id=5007
Requested by: Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 3586813609393017997
tpc.googlesyndication.com/simgad/ Frame 8E28 10 KB
10 KB 12ms
11ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3586813609393017997?w=100&h=100

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4df808f14cbbbb201a14fa137067cd77cf3ad61cdd8ecb64e4aa060eebb6439

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 09:01:55 GMT
x-content-type-options: nosniff
age: 488672
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10302
x-xss-protection: 0
last-modified: Fri, 15 Jul 2022 13:01:02 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 11 Nov 2024 09:01:55 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/17691242304024042836/ Frame 8E28 2 KB
2 KB 12ms
11ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/17691242304024042836/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b9ddc690ee7b603a9a0a11d43fbeabf73fe9c08ac83a02c0f79add2a27e13b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:23:53 GMT
x-content-type-options: nosniff
age: 184954
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2223
x-xss-protection: 0
last-modified: Mon, 27 Jun 2022 07:06:44 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 14 Nov 2024 21:23:53 GMT

GET
DATA 200
OK truncated
/ Frame 8E28 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a319bae1aec7a32b75ee01c45b6e281a8cbbd2bcf520afee96ecb409eaf7585

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 8E28 33 KB
33 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://forex.alghtas.xyz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:01:51 GMT
x-content-type-options: nosniff
age: 186276
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 14 Nov 2024 21:01:51 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1E39 640 B
262 B 20ms
20ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNUcuCFdafwwv2k7p7ylAf5Z-oMDDHdrwQEjiRHJqZcHU6uQYk6c0yKClT9oc36Mh_KruX5h0TE8tEqILsle361mAz1lvbn8ZOjndqfwCKoeY1twtG-hGV90CtbbSeZIzQJbdsT0ykTP8n3wBg6jR5vwgTlqxw1yhvjaRmvW3LbjSKjQO_g

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 1514 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Origin: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 06:30:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65776
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 06:30:11 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 1514 7 KB
3 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:55:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:55:58 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 1514 23 KB
9 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 20:50:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 1514 41 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 22:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6737
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 22:54:10 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 1514 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 92BF 1 KB
643 B 9ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11374
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Sat, 18 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 1514 20 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1514 42 B
63 B 53ms
51ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C8ggpfhP0O7vylfCcVHewMafX7aY2c0ztghnYDoOqcYmghtKlmVxbE4C5N0PaHvL201Oh9DeXrJKAmQ4UdiIZDWlkEHkKSvE8xKIEWFOi3b_rwVIo

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 1514 0
0 17ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSuNHw3D9B31jqfpwRrLWuCNjZgZf3ERAW2t4lPdA04dJ6N1g5i-qbwsJMeSv2dxZbf-42gjkfE1Wm13vxL39MDKtXcvQ
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1514 202 KB
64 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6149 466 B
235 B 21ms
20ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNVPYTB9OqmzMuD4aMhoJ9Py3DqAmj4aldw_bXZjk70COQNTRMtdsiXNWPs7bLEckUNcBfc50fT70WQ5hB9OOFOJqm7UisTHiukIIUg1_5yi_wVJxEnnXDd6M70XzjI5iUzhrxnQxoNzhohwc9XSZwm8e6XmaI2MtbSsOMVIr87fgXNxSB0

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame AA6B 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Origin: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 06:30:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65776
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 06:30:11 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame AA6B 7 KB
3 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:55:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:55:58 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame AA6B 23 KB
9 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 20:50:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame AA6B 41 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 22:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6737
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 22:54:10 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame AA6B 3 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 7B28 1 KB
643 B 8ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11374
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Sat, 18 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame AA6B 20 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AA6B 42 B
63 B 44ms
44ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DYWz8rYRZmkiCzYlQ2euS3aZ1iC8_EHT6lIQEsAxgJ9QIwzQtzeag1pruTosfH1kx9rsDxzlDzW5rfPbElvst-qSCjGEeJo6C2Ljs0Bn8amNXjnls

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame AA6B 0
0 15ms
15ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRtcVfLA98qfTNWtBGQfl23E-PkSZ2Fe1dDKWwmovcwZOzHeCdjF651u0Q6UXBJaItqR_NUHlwATszeZcgvpsdVcwUDWw
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame AA6B 202 KB
64 KB 35ms
34ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3C4C 398 B
222 B 28ms
27ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARinvLb3ATAB&v=APEucNVe3akyYhls4iZIl5_moIND5B0TN6PuqVMamwz5_cvNubPGFMhIsiXX9fJPI1eiW-QiiobvDf51nFA8SJxZnLpHzXpui1piasps7waoSomFwXc59bkFvkVUmfitDVjXaZymF8N1QAHXnxw8zEX1-IRPKZ05OcoGFI8V4lhu8gnMPb2Tqzc

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 202
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 24AB 172 KB
60 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Origin: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 23:16:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5369
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 23:16:58 GMT

GET
H3 200 omrhp_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 24AB 7 KB
3 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:55:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 28229
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3071
x-xss-protection: 0
server: cafe
etag: 10674441169935035545
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:55:58 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 24AB 23 KB
9 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14169
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 20:50:18 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 24AB 41 KB
14 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 22:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6737
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 22:54:10 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 24AB 3 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C3E3 1 KB
643 B 21ms
9ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11374
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Sat, 18 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 24AB 20 KB
8 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 24AB 42 B
63 B 42ms
40ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BaLNM3L6Abr4A0TRi8vvDsEdgqBKZpnN2l-hGIWRVfq814eI1AHCRgpEffFRvs6b1rg8P-tg7-ywbYBDulqiMJr10MGdJ2bmcdw4QGwCkBX1TlMcc

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 24AB 202 KB
64 KB 47ms
44ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame DDF0 0
16 B 26ms
19ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhi9z5v-ATAB&v=APEucNU7N7Np-YzHRcDJPFdoZipIeoKl3SKZjgwCC2CAYNZPSXsn_gBneBIV0H5bjE2u4JbbcEdcftfdI1MlslJGgAmZZijn0Eq71sFDNvF0J8UV2L_2AabFo4-IHQaX8v8ITYrded_99tqsdlQcPZv9rupvUWkZjADkvdlOr2yVO4lYJuTM5tY

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame BF46 89 KB
31 KB 319ms
308ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame BF46 42 B
63 B 52ms
42ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A0a2mOhh8HYGKOrxbVCz4tg0-TmQuTtbTjqdqqnmszaIB6oBjQGsgTQ3UvBmmBjE9RfKMeysdtIT_4lCpIHll9Zi6lo9RKNKbjoUoPkI_lWntD2co

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BF46 0
20 B 53ms
42ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5757475013580904114&x=1&ct=119

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame BF46 3 KB
1 KB 20ms
9ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:28:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37053
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 14:28:54 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame BF46 20 KB
8 KB 27ms
16ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:24:48 GMT
content-encoding: br
x-content-type-options: nosniff
age: 55299
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 09:24:48 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame BF46 0
0 28ms
18ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQZrNClNT33wcRuXan02yNXf-ymo_eUYCxF8GSkMzVWQa3IesDCqCVExMQtv-oHA4LbL_4pDmw92f4KfEk8SDk0Zp6WEQ
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame BF46 202 KB
64 KB 84ms
73ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 1E39
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENgK0rs4elZg3Ctnz8k6ISE&google_cver=1

43 B
273 B

27ms
16ms

Image
image/gif

35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENgK0rs4elZg3Ctnz8k6ISE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNUcuCFdafwwv2k7p7ylAf5Z-oMDDHdrwQEjiRHJqZcHU6uQYk6c0yKClT9oc36Mh_KruX5h0TE8tEqILsle361mAz1lvbn8ZOjndqfwCKoeY1twtG-hGV90CtbbSeZIzQJbdsT0ykTP8n3wBg6jR5vwgTlqxw1yhvjaRmvW3LbjSKjQO_g
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENgK0rs4elZg3Ctnz8k6ISE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 1E39 43 B
136 B 46ms
16ms Image
image/gif 35.244.159.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNUcuCFdafwwv2k7p7ylAf5Z-oMDDHdrwQEjiRHJqZcHU6uQYk6c0yKClT9oc36Mh_KruX5h0TE8tEqILsle361mAz1lvbn8ZOjndqfwCKoeY1twtG-hGV90CtbbSeZIzQJbdsT0ykTP8n3wBg6jR5vwgTlqxw1yhvjaRmvW3LbjSKjQO_g
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 1E39
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEEzjs3G-vu1CuIsZNaQRnEY&google_cver=1

23 B
163 B

35ms
34ms

Image
image/gif

2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEEzjs3G-vu1CuIsZNaQRnEY&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNUcuCFdafwwv2k7p7ylAf5Z-oMDDHdrwQEjiRHJqZcHU6uQYk6c0yKClT9oc36Mh_KruX5h0TE8tEqILsle361mAz1lvbn8ZOjndqfwCKoeY1twtG-hGV90CtbbSeZIzQJbdsT0ykTP8n3wBg6jR5vwgTlqxw1yhvjaRmvW3LbjSKjQO_g
Protocol: H2
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Sat, 18 Nov 2023 00:46:27 GMT
pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEEzjs3G-vu1CuIsZNaQRnEY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 1E39 23 B
163 B 38ms
36ms Image
image/gif 2.16.97.41
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNUcuCFdafwwv2k7p7ylAf5Z-oMDDHdrwQEjiRHJqZcHU6uQYk6c0yKClT9oc36Mh_KruX5h0TE8tEqILsle361mAz1lvbn8ZOjndqfwCKoeY1twtG-hGV90CtbbSeZIzQJbdsT0ykTP8n3wBg6jR5vwgTlqxw1yhvjaRmvW3LbjSKjQO_g
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.97.41 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-16-97-41.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Sat, 18 Nov 2023 00:46:27 GMT
pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET

partner
sync.search.spotxchange.com/ Frame 6149
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESED8upFD0e76Fco_VS713bZs&google_cver=1

0
0

GET partner
sync.search.spotxchange.com/ Frame 6149 0
0

GET
H2 204 sync
ups.analytics.yahoo.com/ups/58269/ Frame 6149 0
125 B 79ms
11ms Image
text/plain 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN3z17QCEOOFn8MEGIXknPEBMAE&v=APEucNVPYTB9OqmzMuD4aMhoJ9Py3DqAmj4aldw_bXZjk70COQNTRMtdsiXNWPs7bLEckUNcBfc50fT70WQ5hB9OOFOJqm7UisTHiukIIUg1_5yi_wVJxEnnXDd6M70XzjI5iUzhrxnQxoNzhohwc9XSZwm8e6XmaI2MtbSsOMVIr87fgXNxSB0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
rtb-csync.smartadserver.com/redir/ Frame 3C4C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=smartrtb_dbm&google_cm&google_dbm
https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESECwVTMSkInoeyrJrM0G9vcg&google_cver=1

43 B
114 B

102ms
17ms

Image
image/gif

185.86.139.94
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESECwVTMSkInoeyrJrM0G9vcg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARinvLb3ATAB&v=APEucNVe3akyYhls4iZIl5_moIND5B0TN6PuqVMamwz5_cvNubPGFMhIsiXX9fJPI1eiW-QiiobvDf51nFA8SJxZnLpHzXpui1piasps7waoSomFwXc59bkFvkVUmfitDVjXaZymF8N1QAHXnxw8zEX1-IRPKZ05OcoGFI8V4lhu8gnMPb2Tqzc
Protocol: H2
Server: 185.86.139.94 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=CAESECwVTMSkInoeyrJrM0G9vcg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
rtb-csync.smartadserver.com/redir/ Frame 3C4C 43 B
113 B 127ms
19ms Image
image/gif 185.86.139.94
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=76&partneruserid=GOOGLE_HOSTED_PI&redirurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsmartrtb_dbm%26google_cm%26google_hm%3DSMART_USER_ID_B64
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARinvLb3ATAB&v=APEucNVe3akyYhls4iZIl5_moIND5B0TN6PuqVMamwz5_cvNubPGFMhIsiXX9fJPI1eiW-QiiobvDf51nFA8SJxZnLpHzXpui1piasps7waoSomFwXc59bkFvkVUmfitDVjXaZymF8N1QAHXnxw8zEX1-IRPKZ05OcoGFI8V4lhu8gnMPb2Tqzc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.94 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:26 GMT
content-type: image/gif

GET
H3 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E28 2 KB
2 KB 9ms
7ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:17:56 GMT
x-content-type-options: nosniff
server: cafe
age: 26911
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 0
expires: Sat, 18 Nov 2023 17:17:56 GMT

GET
H3 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 8E28 295 B
327 B 9ms
8ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:36:38 GMT
x-content-type-options: nosniff
server: cafe
age: 11389
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Sat, 18 Nov 2023 21:36:38 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3548420213117692770/ Frame EB38 15 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d136dde82d6fa957915b1345b932a3a52a6f86a1a4f5979c3e574a965f70c13a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 270245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3570
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 14 Nov 2023 21:42:22 GMT
expires: Wed, 13 Nov 2024 21:42:22 GMT
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 1514 0
0 55ms
55ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjss6Yi-M3o1Scls-2m2pjSXijxa0p5a-v67Nk5wpyaRBTf2UY2NxYj-72ApNzHZ7_S5YeyUApRxH5uiSmcyqlOF94W1gRIYdj7uHopkicUvmjWKHGAKKrPLWU_TXFm51653bXHioAYndgM6Rnj0BtrrRP9RDHDS7taKVFBOXDKUAmzIs6YZupM7ZDAIqg5Kfh2LLi2F5Vy0aK0ykVtwiZgylIhxzMGtaQMacv3GQAdF7KWVNbgesPtXPpqXKrrrgEhPB_VNLENIwl_SUKwnc5uZmGVSc9DCL4sKgQQBL7ufJzeMLKJtDSOLiYNOBBD1L7CkMwL3fi6Y_WfxZdOHJEDHA09rV-vOyiUMvvekZI4YYU7SHtif4_OVyzRofAydnntCHkZK7r6JjbaPdF-GrTuPH43ow9F_cDXXvo-CLSO2Ngm9MrrTqeSqnAUfmvXj6ddwQUV4qJbtA3w2UUVTzf10zC88Z2eeupcFHiI13dsTByICowBVaOUvozdlHmYySlAkJBAOA-FgFaYe3mJZfHSwhZs6RYom-rkkhXtdB4Zi-jcAD3uBwn8ppqwFHKMzBMzsbWJvIgPpD22k4v2CnI620gIeqJ8LtxE8L9ZpdLEjTe0X3x5eMYRulxuobIym41IEggRuFWemUzKEbc6oHZWXwXCYKU-a4Z-bDUeUzk7U8Xrw8BDfKskiP3G1MG8bgfy8wtS_i489yODhuP0RYYpa8DdqjjNivf2skZqpONJo6ohIGNUW90HCI5dWeDOg_MGAAn_HPTJ9hjK4agyWUpw1FExcX3GG0Mv4nHKd_avu_Y8PeIQU3iypfIlollkgSRsJd4hLqz2EH0HPv8MLdypC3YzMSj9auwQ8EZ39lTDKUUM0rIzW6bXh_0bSo7lTJIbrYHNp3OedCS63tmFoSWIhR1IYgXMWbefK4PxeqpsxKovKXUZznY9gVxJ5sfhL6R4eYrb-AuZPgzSHKe6Iw-cbmh_2N93bjHCYWOsyE3lLKOeujBs9FbzvnXEbMOHKPj__9-_oXrLGp58E9g7x4MabcXnDsrFGK2IIoK_d2D6m3_dJWg_sKiv-fwzOIqE3eekS6101j0oGXCKjmz-TynM7pOYyZSXFxNnRo0fC33s0XzNludcS91ojOg8SHdsnKiJ1DJepMcZYr1zOc2Jmb-um5r1LYfeCnBxIL_WH_GDHtweUEl6tslBuJQ1nJxBqGQOOAkqh8VeT75dBH2xRVbZ8pX3O_uHe7i1rI80C4FGPvgvX3TaXTEsSct2zBV6h8USpwZS4HxXlNcC6IVfQ6df917m9cVuwaI10yofwrtAsYnJVym3TjtyaSwntXIadJOlnKs2ClVT7-ZgPuB3un5NGBNwqWTuOBj4y4O7gZOqqZrWRYpaL9gRWRpQXmejwPZowNvVaT6z35WoqVCSVP15BM&sai=AMfl-YT7DZAO0fnNMO-sxSanKTG4uLbbQRt6SKlsqsCQnhbZYBAVRrnpv3n2dGyNt5YmTJnzNbWSfHpsZFKClvN3XsyHFFg0x28yijD00X8EDBHRRp_ThSaBBBcTAPyLfom6IG_GmIDk-Kbhei5tjAUepXzqGzSf7Lu2a3CNyN2SKaumg5fM32n7KAJfBi75p6AqNcFZMreLiDwn_s3SlP1HIeN2CdUGzR1aUeEeJU2e_NE-rC1SWnwBBAFgYsvZO7orOzc6tpMV0Rvcmpk1qJ8n-6_nmT1S6Oljl-MMrviOguf35E45g4wQ0HdIEu6CYYCC-4-sJLovtR5wOnaqFqkwFA9oZLzqKmNGmyBGtXBxLU6rk0BQHyDilsRa68E3BwjY_hd5CX3I9ISlRRZ9bDSlea7rPbqvw0f-MH_vsbuXk4KGLxnIwiw&sig=Cg0ArKJSzD6pdwmg-Y7JEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vYW5kYS5jb20&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=110&cbvp=1&cstd=108&cisv=r20231109.77736&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 92BF
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQ...

43 B
395 B

201ms
183ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 827c324ddc06199b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 209
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTfxKahzy5fjsYVX7KGPw1vC3yD85Aeh9QlHaexAvW8NahibphRTaqaa_XX0uEcbQ2ImNV3SCJtWxO2ZBtAHRVutogzFDQj%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 827c324c9b56199b-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 92BF
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmRC2b9sEv-FDlb8On_ic8nlRCVkXOQTeEiJ4ByzARO-qgr9Hhc2eJ2Pqpz7beWWW5QrRK67iOjSJpwT1hqQ5XRN8XnwmV-m
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3B5F0E3AAA0B4547900FF69E695F74EC&google_push=AXcoOmRC2b9sEv-FDlb8On_ic8nlRCVkXOQTeEiJ4ByzARO-qgr9Hhc2eJ2Pqpz7beWWW5QrRK67iOjSJpwT1hq...

170 B
188 B

27ms
26ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3B5F0E3AAA0B4547900FF69E695F74EC&google_push=AXcoOmRC2b9sEv-FDlb8On_ic8nlRCVkXOQTeEiJ4ByzARO-qgr9Hhc2eJ2Pqpz7beWWW5QrRK67iOjSJpwT1hqQ5XRN8XnwmV-m

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=3B5F0E3AAA0B4547900FF69E695F74EC&google_push=AXcoOmRC2b9sEv-FDlb8On_ic8nlRCVkXOQTeEiJ4ByzARO-qgr9Hhc2eJ2Pqpz7beWWW5QrRK67iOjSJpwT1hqQ5XRN8XnwmV-m
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 17 Nov 2023 00:46:27 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 92BF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmQl5HcTWwMdLCvVWwL8MZ5BPSI4WTf0NoBMPOROR2-7trjIh_9I3sXomvjy_8bjHPeBkpsHuwwregWDRuO-FE0mE3L...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQl5HcTWwMdLCvVWwL8MZ5BPSI4WTf0NoBMPOROR2-7trjIh_9I3sXomvjy_8bjHPeBkpsHuwwregWDRuO-FE0mE3L5FsRN&google_hm=eS0wUnZFY2ZWRTJwRVA4bX...

170 B
188 B

56ms
52ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQl5HcTWwMdLCvVWwL8MZ5BPSI4WTf0NoBMPOROR2-7trjIh_9I3sXomvjy_8bjHPeBkpsHuwwregWDRuO-FE0mE3L5FsRN&google_hm=eS0wUnZFY2ZWRTJwRVA4bXNzOGxvNHdYUElZODBacTFEM35B

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQl5HcTWwMdLCvVWwL8MZ5BPSI4WTf0NoBMPOROR2-7trjIh_9I3sXomvjy_8bjHPeBkpsHuwwregWDRuO-FE0mE3L5FsRN&google_hm=eS0wUnZFY2ZWRTJwRVA4bXNzOGxvNHdYUElZODBacTFEM35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 92BF
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZvs...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZ...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZvsMcBN5

170 B
188 B

22ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZvsMcBN5

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTnq9Zbo-FWs-4YZkxojmpR12hX71t9m9ChG56J7xtIBkObDXEEixJ_vY6ZHjP6UaOFMk6u2jw2h9q9KjM9zn_TZvsMcBN5
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 92BF 0
12 B 15ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K2pz96OrWX8Xn_8-kaDN4QIXr7ONT3oufNrzBgSHuCKqc4-zzt

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 7B28
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNz...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfTh...

43 B
422 B

202ms
183ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 827c324ddc08199b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 129
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTWXWnZ0ZJS_zLtNiovvaFNeYEc3x2MEGQCZ1GdhO1Cjvst5vPjviEyQMw3gPeEdQb3ezT8omxlpgPVdsENyl2zBLyVfThNzg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 827c324cab59199b-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7B28
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmR5N5zuR3wGncKpJ87CImVz_rMwFU4SgabM9DlNmj8f30qurAv5oSdVGf-i_riEFhHsNbZcRnsJlvKhg45IQH29KBbYa2QN9w
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=5B280CF3040248729EC43E93BC6C189A&google_push=AXcoOmR5N5zuR3wGncKpJ87CImVz_rMwFU4SgabM9DlNmj8f30qurAv5oSdVGf-i_riEFhHsNbZcRnsJlvKhg45...

170 B
188 B

27ms
25ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=5B280CF3040248729EC43E93BC6C189A&google_push=AXcoOmR5N5zuR3wGncKpJ87CImVz_rMwFU4SgabM9DlNmj8f30qurAv5oSdVGf-i_riEFhHsNbZcRnsJlvKhg45IQH29KBbYa2QN9w

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=5B280CF3040248729EC43E93BC6C189A&google_push=AXcoOmR5N5zuR3wGncKpJ87CImVz_rMwFU4SgabM9DlNmj8f30qurAv5oSdVGf-i_riEFhHsNbZcRnsJlvKhg45IQH29KBbYa2QN9w
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 17 Nov 2023 00:46:27 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7B28
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmTdsw5lynY7utFiTwM01o5XxVpM5aV5UGv5dS32R9dvHpmVOlGvMgBQ5mKz8Cx7xU5hGPUQMGWej7NZZFhBMQoEnKh...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTdsw5lynY7utFiTwM01o5XxVpM5aV5UGv5dS32R9dvHpmVOlGvMgBQ5mKz8Cx7xU5hGPUQMGWej7NZZFhBMQoEnKhj3uAGBw&google_hm=eS1aNFl4UXNsRTJwRjVF...

170 B
188 B

23ms
19ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTdsw5lynY7utFiTwM01o5XxVpM5aV5UGv5dS32R9dvHpmVOlGvMgBQ5mKz8Cx7xU5hGPUQMGWej7NZZFhBMQoEnKhj3uAGBw&google_hm=eS1aNFl4UXNsRTJwRjVFdlBXeFdfZjRXTGdJZTlMTFJqQn5B

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmTdsw5lynY7utFiTwM01o5XxVpM5aV5UGv5dS32R9dvHpmVOlGvMgBQ5mKz8Cx7xU5hGPUQMGWej7NZZFhBMQoEnKhj3uAGBw&google_hm=eS1aNFl4UXNsRTJwRjVFdlBXeFdfZjRXTGdJZTlMTFJqQn5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7B28
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4RN...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4RNEo7dy3g

170 B
188 B

21ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4RNEo7dy3g

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmSXR6tt6xX7KJFLwCbSbWanStmzA4UTakLmgwulq3R-eUOjO4GeSX0Xi3AuYTNFhWNdQKKkg-KnYHvLtorllahu4RNEo7dy3g
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 7B28 0
12 B 15ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JlwGBqRNXswjICBVgbenH_qAkZBNJM6WkYyodqe5oQL2P58hRC

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/3548420213117692770/ Frame AD15 15 KB
4 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d136dde82d6fa957915b1345b932a3a52a6f86a1a4f5979c3e574a965f70c13a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 270245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3570
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 14 Nov 2023 21:42:22 GMT
expires: Wed, 13 Nov 2024 21:42:22 GMT
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame AA6B 0
0 52ms
52ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvB7tbSt7xuBgo8z5K1Z1RDgYyq3Drg0g9VTJNWnbvkE5JMWnvlHtpP61Zz8skLtOeXyAvppujAVrBm2BBaYcBTf85F5PYLaAuR-d-nhIR64E6joiJjUcqkmUyN2n2e3At7U9YqbuJX44KFfT6c4R6ETEFo3gNtkc8H620tIctxxPWJjmBZuV1RaFTduFDFlbb2_Xjwi8fD671P_Bg0LhuTPbMvERwckCj7rZ_C3T65v1GSCOfwTE45L-0kJd7avh80ycQPD16tjHJ7SO3EdUl1PAyZflW6OvBYmUrXGoqWA8DLi8MT4hwLF6FH1ZXXN7ei48gxGDvF7UhU1gNAV4Syv2qMh_dfvtFT9BDR0TvGf4gZveXvkNKcAwLgouJm7qsYmJwfiKjsYTP5X4cMIRtt-spdPJt3ep63DjRUHn8MP4AIRrpJKKCZGBCMGghmFuYxb5CfjPJke7aqYS8xQdUPTVqFogXBXYn9w6DOxNC9yzQoPmbmne5FXjV97DP-yjS8zz09zuCngRzLhKi8rEYZoxf4d5BBSJ8CPDpYC05fu-H8O2qfSgnrsL1iSXALdHYszwOriYY7XwsLAM6A8UwkBe0i4290Ytuf8uhqXUxHuStVxlYvVpwOYHqgSPXVUasXs5tetBAfG_6kOActutZhrzZvNZnBy09mP39sYft8AGDAuElkLWxQZlo4KtXKflEHl0uZVGkjDaN9ulJCiOO3_d8JIQ4YzcGpkGhR5xr1gvX9zmfdaSg3WfzvdAPu6JuzneTrVx-XplSYR-3dCdrtcMIXfZfds7_PzgvAgzW9Rl2-EfYZ7QyjMiQHjqHPyJFPm4s60LXuHSQaT9pAVlNGVKinKQaavkAYeKph3BfqhDqPDp92iIUfONW0AVb2grUTmO03CxDhYsHnclnb0gKOtAk0sCFwUHLte7p4ekxRxhhTAvIFiBo4cmVkCO0XuJEXcOcCB7RMdnEyjX0HooNgLzVhWf-tpu3Yo87oMhx5Lr9XwrgIOCX23Kx-3wGnyXLbJKg9X8uoOBZTIWEkrLUK8KGvDvOHsYOjz4912IkbFgfRtmVzELWvFBLAogsp8M5Yf2RSYUVShJvuIYc4cGr5zfFQfmk6TW0Y0NWahA59ulQqrkgn7hj0jJJy79__e1uGS6Z89L0pZn9uLJgY3MkN1Zmv-FCugMoGgNQp1eA4tDWQglxBdyYdIbp_YHeChbAdXsBHLR70JbVKtlAeUcEhw2E2XtvC0PRaavYQxmiqek2B88eUgjbr9ioqGjSgHQnRHCQXOZ9xWyRCuckYVxSUT8q8OWmJt0gKT8nH-YvMT8nvDie0hI1N2yOHK8ZXDGNstNBIyAVfMAafhNP4RUffoFEYy5O6RZ4C4BcFtcIE_m7ct9_34scUxNHjbuSygAJn1lQRxMnSdEtjoWXeMU5xxWtynA&sai=AMfl-YTYoye_SG44lWHRF7YlRhc03-K6nCJEVvRpGwLSnAkgMCqomhjVqUfAJG58lCHmhXASpVnixecM8UTutx-p1Pheb-pkBGxMDiKMcUaQypvwriowfnaEwohyYD-9TlFtmZJ1FwRnpCpv64hRG0GQAxB0UKusErbgrB2MKeOCH-hc5eDJJyxS3TxhnhbM-tW6f_uoky7xJjcVtKGeWC5epuvOnlDkoNp1VomWocBiHrQWx44kX6tRxALjrGkqrw5oYMd58vlRkDMEGO4b7Bk76ZhFI5GHtS-3P-nO7wKueBRtqZ01W7Xw7tRvHa0kpFJf2XuYaCMAcLjk85iRn53YCWn8K4EXbJF3LPgaKbxoGY7NZtAqGqilaP58X1eLjAi18SQ7zHO-e9cmAz3ZNHDxcqxjxtvfpT66Nw9EmhfVo2xpicfY8aI&sig=Cg0ArKJSzM_UndfJZpknEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vYW5kYS5jb20&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=119&cbvp=1&cstd=118&cisv=r20231109.33203&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame C3E3
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRva...

43 B
414 B

200ms
182ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 827c324ddc05199b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 129
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQZI4hpMoMB4V3uVtEtuZqqRbZceRbAy18Y8wqfzra2z_5YISsJZGBSJU3FJA5ajMqD10dQJGbyXx946xfXleArMgdtRvaC%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 827c324cab5a199b-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3E3
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmRRiKKv32FAvMTThDpmyyfiCdASrovEt8yefbhdeLUvilZhT1fAaAqCot8JxnUcjLYBuiZIUox0bFI3K2NgJ2KtTY7veX4
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmRRiKKv32FAvMTThDpmyyfiCdASrovEt8yefbhdeLUvilZhT1fAaAqCot8JxnUcjLYBuiZIUox0bFI3K2N...

170 B
188 B

28ms
26ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmRRiKKv32FAvMTThDpmyyfiCdASrovEt8yefbhdeLUvilZhT1fAaAqCot8JxnUcjLYBuiZIUox0bFI3K2NgJ2KtTY7veX4

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmRRiKKv32FAvMTThDpmyyfiCdASrovEt8yefbhdeLUvilZhT1fAaAqCot8JxnUcjLYBuiZIUox0bFI3K2NgJ2KtTY7veX4
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 17 Nov 2023 00:46:27 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3E3
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmQyDLyI6V2NQmGHDpxZdcTohz_iXm-fUBrqApn7VVJERpDTIIQNsHVpUmbIHwGtAMePMl68tadDei45NMGxhtSb5j5...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQyDLyI6V2NQmGHDpxZdcTohz_iXm-fUBrqApn7VVJERpDTIIQNsHVpUmbIHwGtAMePMl68tadDei45NMGxhtSb5j5H_tri&google_hm=eS01NTRSNlhGRTJwR01sUk...

170 B
188 B

21ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQyDLyI6V2NQmGHDpxZdcTohz_iXm-fUBrqApn7VVJERpDTIIQNsHVpUmbIHwGtAMePMl68tadDei45NMGxhtSb5j5H_tri&google_hm=eS01NTRSNlhGRTJwR01sUkUzZEZwbzU2WVlSZGNBdTBZcH5B

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQyDLyI6V2NQmGHDpxZdcTohz_iXm-fUBrqApn7VVJERpDTIIQNsHVpUmbIHwGtAMePMl68tadDei45NMGxhtSb5j5H_tri&google_hm=eS01NTRSNlhGRTJwR01sUkUzZEZwbzU2WVlSZGNBdTBZcH5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C3E3
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmFb0...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmF...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmFb08G3HP

170 B
188 B

20ms
16ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmFb08G3HP

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTH50q9qATEr08D0-p8S2veMfML_ht7uPYp-2VhqWi6CRhKV0S8oZ-Qicdcy9fcz1UytTGUhBi73JaMXccpdpMmFb08G3HP
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C3E3 0
12 B 16ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LxkXma203T6gCa5bFqG5PySj9ekHbnkRVxgGsgFtkCMl32UhWK

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a37da854e118425728716a7db454a8aa.png
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 18 KB
18 KB 7ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/a37da854e118425728716a7db454a8aa.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d7e4717b00089b5fe09f64ffc7c582128baf5577e146e6f7878ff76e6333374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 23:45:24 GMT
x-content-type-options: nosniff
age: 349263
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18857
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Nov 2024 23:45:24 GMT

GET
H3 200 480913a834017fc69d6fdcc15f1e4658.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 2 KB
1023 B 9ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/480913a834017fc69d6fdcc15f1e4658.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2ef506f97a32c27aee78050421695d57a16852e97fe21e93bf60b48895bb770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 09:39:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 486419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Nov 2024 09:39:28 GMT

GET
H3 200 174805ccb393fdfeac4740ba1e10c14c.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 3 KB
1 KB 9ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/174805ccb393fdfeac4740ba1e10c14c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04cf711116f1fa929429ed20aa11ec4a6be116dce322e5356cc27f14e3157583

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:12:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1211
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Nov 2024 21:12:04 GMT

GET
H3 200 8a82c204c1d53dc4efa86a1c50fdad9c.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 170 B
198 B 9ms
8ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/8a82c204c1d53dc4efa86a1c50fdad9c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02b21d5ddc1521d729fd6157fe5222c1aeafd6d32b59f40fc02dfb8a3b64a418

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 19:51:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104090
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 160
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 19:51:37 GMT

GET
H3 200 d0489abc7c8c285e748a9a47e22096bf.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 29 KB
6 KB 7ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/d0489abc7c8c285e748a9a47e22096bf.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5763d37aa015376976cd4cfd8ec0c1fc2536bdef0a9ca1da1670e2d1219f4fbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:02:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2650
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6249
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 17 Nov 2024 00:02:17 GMT

GET
H3 200 e806082474ca904318c561ad1331a02d.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 3 KB
1 KB 11ms
11ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/e806082474ca904318c561ad1331a02d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2a3a2f67668b360af3706c7ae2da7df902f9375ab9ea284ae959f2fa43bbd55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:30:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90953
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 23:30:34 GMT

GET
H3 200 65ed44fbc14ad11d756fb3b317fa0e2d.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 4 KB
1 KB 18ms
14ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/65ed44fbc14ad11d756fb3b317fa0e2d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d61c044067e0201fe4a58d48f092e2791dde05ac429a721260f4168da1143b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:56:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24595
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1467
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 17:56:32 GMT

GET
H3 200 66267d44cc7b601d9f716cbf95a9bb93.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 4 KB
1 KB 26ms
25ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/66267d44cc7b601d9f716cbf95a9bb93.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29431992f8789a95b85a5ae40c7eb0b29065013a53fb69e52e24d439bee63932

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:12:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1473
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Nov 2024 21:12:04 GMT

GET
H3 200 cfb7527e83685fd84ba2c757ae95728e.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 144 B
178 B 10ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/cfb7527e83685fd84ba2c757ae95728e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0841b43610f53c5ab7259c11e0a8935c2c4e749fd0af052bfdd01fdb7f259897

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:30:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90953
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 23:30:34 GMT

GET
H3 200 21f7dff1151b2374c08bda1785e1cd1c.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame EB38 272 B
235 B 8ms
8ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/21f7dff1151b2374c08bda1785e1cd1c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d09330d8772f0b916d1b9e56009d2e205358b0a593739839009e1fe0383eca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:12:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 197
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Nov 2024 21:12:04 GMT

GET
H3 200 300x075.html Show response
s0.2mdn.net/sadbundle/6063756018175705088/ Frame 1D82 48 KB
12 KB 16ms
15ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dd4d9c5d7987a600fa300712b658e2fe334d4d6fc5a3ae1cf07a9b94c9740d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 00:46:27 GMT
expires: Sun, 17 Nov 2024 00:46:27 GMT
last-modified: Wed, 15 Feb 2023 15:30:19 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 24AB 0
0 57ms
57ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst9Ymzjl8SlWmAph2xLiEY7nyreXC1AsrUrek8XLPgi5tDIU_LrO3Fd4bKpoTI_J91uUrnHcdCbyUxPqpXdbZHp3OT-kW-aR3ZJaAxJBglvmgSPF9m5UXaVZcmY8m54aqKFG3fKXXrBjY9aKr50zRXwduesegi3PChBkPWAykSsxg2GhHl3fauk_N4RcImvhg2qWBEn8h04d8nof17YXGWSghlCnmzNnjUxN8JvciWXT7HjrvDRKI_L9T06kun41RLV7hiO8fwoAZ9UeyDpqvUxQyWznV6pyLS_a8bvKEwwFqkFtZ0QI-v98nnAUmKDx2sPu4ZGextnEa9wrfwd8T0F9F9zSuJWZHxMWibNXbXJI1R_pPf0xoVqRMPHseyNYOLk9BZ44MCs0m5UOJiI0-aMMEr7krn9l4eloKXVR3qeqQ_zuOUyN-iN9Rc78v4UcCw8i0B5zNIdbMkc1oBzpnzaPI1snRAmlawxSlJVGkboZKCKLLtqqO08ECO-skxfpvewpAA-XGnhQVh-nwc7f-SxVfvZyHph05BGTDXna4LmGunzIa71rbLQ_hzjhWWGWosrs-x-Tg3arO_Lcx-dh6d8CHQFchdR6TGjRml_xH_Sh60HDd4tzytJ_k-N1M7TiTxVLVIYIgspDe7_M1zJOnW0I0I0MMM3L2t35DIS4pgxhLp3XgjwSW2-t78TMwIlAfpfA6o69UjOfNgBEsiyYrrR4lAzNcQ2-0U8zTrr5aXoSR66noeSxlk927xcehvi72d7FXNgutRGWtCKeeQ_kyWm3FXf18IGIvm9YE6azHB18u2ovAvmELYhIYRf7CvTv79fbyyGyWVln1wxYXozYnifeTzbXOKRN3khxaH_3Cxc96UKQwP7lRPZOj6wwV0v25AuXuYGV0Ghb8d5Vr9pl5oIROdcRu2BZcLWCFTYBZ0RkiRYd-D2SVF_A9nXRgwxX7kKpju-Qx1j-mql7cUlSXo85grYv75RTRNRbhCaR6aCVDMjfXkN1tdzQs5ikExCUtW59KL0mz48W4l0EsKYGN4KexfvIYo_zl8g7waiUIH25MQ0fTk9r7LvzV1EG_kg9SYzHa2FXczIpdiAv7d3iVKTcghFFa2ObbcMW7tIHengFDqkjPRutLh-jcfquOQ7PnZGOMjQDnRwis-PEZ_2yQwcufzoEraB8K5SXoZoQGMEdjXXuY8eVHb7uqESaS-iB4uZG7x8knW1H1WcC4zlpFA9kMbV4QF7EU33zDXLz_-Fnhw2j2IrgxyZHy1ojwnFJ5ULZSQxc0PDKHXkY5PtfbR29tS3kWEtXHwq3-JvKZ8uH-2T-RnhtNY5fCggjRYv-xGgl853U7iQPPvu5gLdyRN3-MVPxyqdIt-JKb0SvoyBPN5JgI5s2XlS7LL3Gx88eZcVXBK--RyqGJ42iIoTh1XlI6qhV5p_s4n8XYT7OeoAaw&sai=AMfl-YRIRXXGqDTEtk0opFtxpEOtALoRF7xTvxQEgmiDdB56NdsSADK2JqPJmD0VyfO_scRJDo-Tgo9onwzdYeWdKoAxtSvJ5-klC9c3CDkcMVLxxsof3flOwr3TuTjRPKdmITL1N_jnkhIoh3WLNW31vi0fIWhcMZRLqIxyfxqN8fdV6gENvfhhMMMzLX5MPPlvewWumGxJj9PWWgIno0M7eYezwp_TlMFAkUseu9DWc_w1AAePxWVZNhGjZfo8id48BhV5IV044YvDzf9IvobUZXyLRdbaF38BwX08b6h-UcVXzRh_I2qe8uCrWw30bb-cqPxdfqvFJiyomA209OMFrEjLq1Z9L9bumK5WWcT7lic0_IlnozXQMivbAf9Hms84kE6HaWv6ZQqEJA3xguS1ZyfIFslfXS7cMy8nXC4vkiTtHgdqaQ&sig=Cg0ArKJSzLeIa0qOUMlZEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vMm9ubGluZS5kZQ&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=125&cbvp=1&cstd=117&cisv=r20231109.79622&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 1514 221 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6cbe1eb742bec0d1f2ff2ac196d6acd6c7bb6c6c4478d4b8df03ebdf9db35a8d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame BAC3 38 KB
13 KB 16ms
13ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 122502
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 14:44:45 GMT
expires: Fri, 15 Nov 2024 14:44:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5A0B 38 KB
13 KB 19ms
7ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 122502
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 14:44:45 GMT
expires: Fri, 15 Nov 2024 14:44:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame AA6B 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 902d2fe5a28ca640f1ab4888afdf2ab02cc6d74424756fc7a7fea554dcd05693

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 a37da854e118425728716a7db454a8aa.png
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 18 KB
18 KB 11ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/a37da854e118425728716a7db454a8aa.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d7e4717b00089b5fe09f64ffc7c582128baf5577e146e6f7878ff76e6333374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 23:45:24 GMT
x-content-type-options: nosniff
age: 349263
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18857
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Nov 2024 23:45:24 GMT

GET
H3 200 480913a834017fc69d6fdcc15f1e4658.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 2 KB
1023 B 11ms
8ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/480913a834017fc69d6fdcc15f1e4658.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c2ef506f97a32c27aee78050421695d57a16852e97fe21e93bf60b48895bb770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 09:39:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 486419
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 985
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 11 Nov 2024 09:39:28 GMT

GET
H3 200 174805ccb393fdfeac4740ba1e10c14c.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 3 KB
1 KB 14ms
13ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/174805ccb393fdfeac4740ba1e10c14c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04cf711116f1fa929429ed20aa11ec4a6be116dce322e5356cc27f14e3157583

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:12:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1211
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Nov 2024 21:12:04 GMT

GET
H3 200 8a82c204c1d53dc4efa86a1c50fdad9c.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 170 B
198 B 12ms
9ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/8a82c204c1d53dc4efa86a1c50fdad9c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

02b21d5ddc1521d729fd6157fe5222c1aeafd6d32b59f40fc02dfb8a3b64a418

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 19:51:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 104090
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 160
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 19:51:37 GMT

GET
H3 200 d0489abc7c8c285e748a9a47e22096bf.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 29 KB
6 KB 7ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/d0489abc7c8c285e748a9a47e22096bf.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5763d37aa015376976cd4cfd8ec0c1fc2536bdef0a9ca1da1670e2d1219f4fbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:02:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2650
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6249
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 17 Nov 2024 00:02:17 GMT

GET
H3 200 e806082474ca904318c561ad1331a02d.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 3 KB
1 KB 8ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/e806082474ca904318c561ad1331a02d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2a3a2f67668b360af3706c7ae2da7df902f9375ab9ea284ae959f2fa43bbd55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:30:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90953
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1076
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 23:30:34 GMT

GET
H3 200 65ed44fbc14ad11d756fb3b317fa0e2d.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 4 KB
1 KB 10ms
10ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/65ed44fbc14ad11d756fb3b317fa0e2d.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d61c044067e0201fe4a58d48f092e2791dde05ac429a721260f4168da1143b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:56:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24595
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1467
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 16 Nov 2024 17:56:32 GMT

GET
H3 200 66267d44cc7b601d9f716cbf95a9bb93.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 4 KB
1 KB 12ms
12ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/66267d44cc7b601d9f716cbf95a9bb93.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29431992f8789a95b85a5ae40c7eb0b29065013a53fb69e52e24d439bee63932

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:12:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1473
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Nov 2024 21:12:04 GMT

GET
H3 200 cfb7527e83685fd84ba2c757ae95728e.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 144 B
178 B 8ms
7ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/cfb7527e83685fd84ba2c757ae95728e.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0841b43610f53c5ab7259c11e0a8935c2c4e749fd0af052bfdd01fdb7f259897

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 23:30:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 90953
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 15 Nov 2024 23:30:34 GMT

GET
H3 200 21f7dff1151b2374c08bda1785e1cd1c.svg
s0.2mdn.net/sadbundle/3548420213117692770/images/ Frame AD15 272 B
235 B 15ms
15ms Image
image/svg+xml 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/3548420213117692770/images/21f7dff1151b2374c08bda1785e1cd1c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d09330d8772f0b916d1b9e56009d2e205358b0a593739839009e1fe0383eca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3548420213117692770/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 15 Nov 2023 21:12:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185663
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 197
x-xss-protection: 0
last-modified: Wed, 19 Jul 2023 14:05:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 14 Nov 2024 21:12:04 GMT

GET
DATA 200
OK truncated
/ Frame 24AB 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ead5b99e6b351a021b377a3db8292e3676aee695fe4bb023de0babbd4693b1f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 88C6 38 KB
13 KB 7ms
7ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 122502
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 14:44:45 GMT
expires: Fri, 15 Nov 2024 14:44:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 1D82 118 KB
40 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 23:26:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4770
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 23:26:57 GMT

GET
H3 200 gsap_3.9.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 1D82 63 KB
25 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.9.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25329
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 19:08:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 1514 0
0 46ms
45ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjss6Yi-M3o1Scls-2m2pjSXijxa0p5a-v67Nk5wpyaRBTf2UY2NxYj-72ApNzHZ7_S5YeyUApRxH5uiSmcyqlOF94W1gRIYdj7uHopkicUvmjWKHGAKKrPLWU_TXFm51653bXHioAYndgM6Rnj0BtrrRP9RDHDS7taKVFBOXDKUAmzIs6YZupM7ZDAIqg5Kfh2LLi2F5Vy0aK0ykVtwiZgylIhxzMGtaQMacv3GQAdF7KWVNbgesPtXPpqXKrrrgEhPB_VNLENIwl_SUKwnc5uZmGVSc9DCL4sKgQQBL7ufJzeMLKJtDSOLiYNOBBD1L7CkMwL3fi6Y_WfxZdOHJEDHA09rV-vOyiUMvvekZI4YYU7SHtif4_OVyzRofAydnntCHkZK7r6JjbaPdF-GrTuPH43ow9F_cDXXvo-CLSO2Ngm9MrrTqeSqnAUfmvXj6ddwQUV4qJbtA3w2UUVTzf10zC88Z2eeupcFHiI13dsTByICowBVaOUvozdlHmYySlAkJBAOA-FgFaYe3mJZfHSwhZs6RYom-rkkhXtdB4Zi-jcAD3uBwn8ppqwFHKMzBMzsbWJvIgPpD22k4v2CnI620gIeqJ8LtxE8L9ZpdLEjTe0X3x5eMYRulxuobIym41IEggRuFWemUzKEbc6oHZWXwXCYKU-a4Z-bDUeUzk7U8Xrw8BDfKskiP3G1MG8bgfy8wtS_i489yODhuP0RYYpa8DdqjjNivf2skZqpONJo6ohIGNUW90HCI5dWeDOg_MGAAn_HPTJ9hjK4agyWUpw1FExcX3GG0Mv4nHKd_avu_Y8PeIQU3iypfIlollkgSRsJd4hLqz2EH0HPv8MLdypC3YzMSj9auwQ8EZ39lTDKUUM0rIzW6bXh_0bSo7lTJIbrYHNp3OedCS63tmFoSWIhR1IYgXMWbefK4PxeqpsxKovKXUZznY9gVxJ5sfhL6R4eYrb-AuZPgzSHKe6Iw-cbmh_2N93bjHCYWOsyE3lLKOeujBs9FbzvnXEbMOHKPj__9-_oXrLGp58E9g7x4MabcXnDsrFGK2IIoK_d2D6m3_dJWg_sKiv-fwzOIqE3eekS6101j0oGXCKjmz-TynM7pOYyZSXFxNnRo0fC33s0XzNludcS91ojOg8SHdsnKiJ1DJepMcZYr1zOc2Jmb-um5r1LYfeCnBxIL_WH_GDHtweUEl6tslBuJQ1nJxBqGQOOAkqh8VeT75dBH2xRVbZ8pX3O_uHe7i1rI80C4FGPvgvX3TaXTEsSct2zBV6h8USpwZS4HxXlNcC6IVfQ6df917m9cVuwaI10yofwrtAsYnJVym3TjtyaSwntXIadJOlnKs2ClVT7-ZgPuB3un5NGBNwqWTuOBj4y4O7gZOqqZrWRYpaL9gRWRpQXmejwPZowNvVaT6z35WoqVCSVP15BM&sai=AMfl-YT7DZAO0fnNMO-sxSanKTG4uLbbQRt6SKlsqsCQnhbZYBAVRrnpv3n2dGyNt5YmTJnzNbWSfHpsZFKClvN3XsyHFFg0x28yijD00X8EDBHRRp_ThSaBBBcTAPyLfom6IG_GmIDk-Kbhei5tjAUepXzqGzSf7Lu2a3CNyN2SKaumg5fM32n7KAJfBi75p6AqNcFZMreLiDwn_s3SlP1HIeN2CdUGzR1aUeEeJU2e_NE-rC1SWnwBBAFgYsvZO7orOzc6tpMV0Rvcmpk1qJ8n-6_nmT1S6Oljl-MMrviOguf35E45g4wQ0HdIEu6CYYCC-4-sJLovtR5wOnaqFqkwFA9oZLzqKmNGmyBGtXBxLU6rk0BQHyDilsRa68E3BwjY_hd5CX3I9ISlRRZ9bDSlea7rPbqvw0f-MH_vsbuXk4KGLxnIwiw&sig=Cg0ArKJSzD6pdwmg-Y7JEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vYW5kYS5jb20&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=349&vt=11&dtpt=239&dett=3&cstd=108&cisv=r20231109.77736&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 44ms
44ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202311090101&jk=207926523343629&bg=!OTqlOnXNAAZxrfrxUa07ADQBe5WfOGCxF3RijwHzaCvJkadOmZ6iAjGX88dLxUT2VCHzq-jFGgI5EASgDgEpyn6zNM_7AgAAAFJSAAAAA2gBB5kCxuugyxs-V-2jL4Fw33W5ZUl5R_X5UIJtGpyROamF9yXAt1D2kk0-MpVoXkWtsEG_L8Tf6mF3bhhcdBjvFkaoKlmC1n3PWIMZ6qNUhmRdbfO44amh0ZEOg28Tzn_kDkC_LgVlJn4HzWVUE6WAHqYbuMERc6F8alHbTlYk1xXUtHexVBeFU3VeNY03pZ-XSV9Ke4HrVewtM_cmooda4ox2Ywgh9HwRElKjX15pntMDpxjBdnPU2GFnr8K6VcxUzXKXfLvaIjIAeZljkYbm2_VhGwVHrvXC4-Mc4TqB559E9XJOGLR84-aIQhyREucDxNK81SOmoUJK3jsole1E5OWrp-faz0ys1Ow2U89q-i8JJ-EnamzhxkECPFtUmFfavOY5NII-S_PoND_PbkLU1YAt2H3henAAGT9YiMti7lNgq78fQ0GrhRKaFSDg2AfF6Qe53lcILrLdIezCSqxrExSIzMTydhFztoVcen1EXB5aYSBGNYjCvh6GAlyyKwyUHU3fyENJnzx7Z7jRJ-RdJP3wq6BkzA6fofF-ZWJTpCPCKowWym8xlHYmvI8Mx19rlX1cfpd-VQy2TrUfeFQXkawdlDgmtFY_KXO3n7TzxzyLUG8-W7foY61Kk0cu3bhgdA-QgDxRbizyf1AU9P7ewLHXzeVs0EcUpHYjG53jxjJqTfbHGc-PshvuHik6nlapjmoQkjzVQThXrl6mbLGLPUKI5Y1-ai8VGq8dpnOHQOxWGWHsqwjgIVQAwzoHONuhIpQabqTW93euBTkghl387fWkiIhAyuUsEfSFBeST200oumNgCIjweVpj2avvC1C_le3bf-H_nP6cI4PStKyIqjnSpJJBlglBz7CAb3IAUmj5thwUz4UeS0Ot1bK76h5hTdm25W4us8XlyyYJivpsoAIhxD9o11l7F2gjwRthcz0KIfP6JWSeY5N6
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame AA6B 0
0 49ms
47ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjsvB7tbSt7xuBgo8z5K1Z1RDgYyq3Drg0g9VTJNWnbvkE5JMWnvlHtpP61Zz8skLtOeXyAvppujAVrBm2BBaYcBTf85F5PYLaAuR-d-nhIR64E6joiJjUcqkmUyN2n2e3At7U9YqbuJX44KFfT6c4R6ETEFo3gNtkc8H620tIctxxPWJjmBZuV1RaFTduFDFlbb2_Xjwi8fD671P_Bg0LhuTPbMvERwckCj7rZ_C3T65v1GSCOfwTE45L-0kJd7avh80ycQPD16tjHJ7SO3EdUl1PAyZflW6OvBYmUrXGoqWA8DLi8MT4hwLF6FH1ZXXN7ei48gxGDvF7UhU1gNAV4Syv2qMh_dfvtFT9BDR0TvGf4gZveXvkNKcAwLgouJm7qsYmJwfiKjsYTP5X4cMIRtt-spdPJt3ep63DjRUHn8MP4AIRrpJKKCZGBCMGghmFuYxb5CfjPJke7aqYS8xQdUPTVqFogXBXYn9w6DOxNC9yzQoPmbmne5FXjV97DP-yjS8zz09zuCngRzLhKi8rEYZoxf4d5BBSJ8CPDpYC05fu-H8O2qfSgnrsL1iSXALdHYszwOriYY7XwsLAM6A8UwkBe0i4290Ytuf8uhqXUxHuStVxlYvVpwOYHqgSPXVUasXs5tetBAfG_6kOActutZhrzZvNZnBy09mP39sYft8AGDAuElkLWxQZlo4KtXKflEHl0uZVGkjDaN9ulJCiOO3_d8JIQ4YzcGpkGhR5xr1gvX9zmfdaSg3WfzvdAPu6JuzneTrVx-XplSYR-3dCdrtcMIXfZfds7_PzgvAgzW9Rl2-EfYZ7QyjMiQHjqHPyJFPm4s60LXuHSQaT9pAVlNGVKinKQaavkAYeKph3BfqhDqPDp92iIUfONW0AVb2grUTmO03CxDhYsHnclnb0gKOtAk0sCFwUHLte7p4ekxRxhhTAvIFiBo4cmVkCO0XuJEXcOcCB7RMdnEyjX0HooNgLzVhWf-tpu3Yo87oMhx5Lr9XwrgIOCX23Kx-3wGnyXLbJKg9X8uoOBZTIWEkrLUK8KGvDvOHsYOjz4912IkbFgfRtmVzELWvFBLAogsp8M5Yf2RSYUVShJvuIYc4cGr5zfFQfmk6TW0Y0NWahA59ulQqrkgn7hj0jJJy79__e1uGS6Z89L0pZn9uLJgY3MkN1Zmv-FCugMoGgNQp1eA4tDWQglxBdyYdIbp_YHeChbAdXsBHLR70JbVKtlAeUcEhw2E2XtvC0PRaavYQxmiqek2B88eUgjbr9ioqGjSgHQnRHCQXOZ9xWyRCuckYVxSUT8q8OWmJt0gKT8nH-YvMT8nvDie0hI1N2yOHK8ZXDGNstNBIyAVfMAafhNP4RUffoFEYy5O6RZ4C4BcFtcIE_m7ct9_34scUxNHjbuSygAJn1lQRxMnSdEtjoWXeMU5xxWtynA&sai=AMfl-YTYoye_SG44lWHRF7YlRhc03-K6nCJEVvRpGwLSnAkgMCqomhjVqUfAJG58lCHmhXASpVnixecM8UTutx-p1Pheb-pkBGxMDiKMcUaQypvwriowfnaEwohyYD-9TlFtmZJ1FwRnpCpv64hRG0GQAxB0UKusErbgrB2MKeOCH-hc5eDJJyxS3TxhnhbM-tW6f_uoky7xJjcVtKGeWC5epuvOnlDkoNp1VomWocBiHrQWx44kX6tRxALjrGkqrw5oYMd58vlRkDMEGO4b7Bk76ZhFI5GHtS-3P-nO7wKueBRtqZ01W7Xw7tRvHa0kpFJf2XuYaCMAcLjk85iRn53YCWn8K4EXbJF3LPgaKbxoGY7NZtAqGqilaP58X1eLjAi18SQ7zHO-e9cmAz3ZNHDxcqxjxtvfpT66Nw9EmhfVo2xpicfY8aI&sig=Cg0ArKJSzM_UndfJZpknEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vYW5kYS5jb20&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=397&vt=11&dtpt=278&dett=3&cstd=118&cisv=r20231109.33203&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BF46 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=237050122911&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BF46 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=237050122911&version=m202309260101&ct=119&x=1&cor=5757475013580904000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame BF46 90 KB
38 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BdCuOijC4hS1TVdrS3KWE383eub3MNNfoIPnF0N9B6H6s0I6iimXJEmiVyB0dubT5PBOriG1tO8CV6WwO8yThnzJ86TTWzi2sxyLwPsz5mXo_gp9tpziKQJZfqtAp41iGr2XcHseBFvQGe8MBC_yZYPt3eD4ni_m0bVoin55Ooh4pCGj8&cry=1&dbm_d=AKAmf-AzLeQuCSH7bswG00BKySM2TzdtezcDztoGtTkvqFN0WPySy545CPg8jE51L4GEh2e8m8qDBxYe3KagoushsLyI7m_75xAKtJ1yV1zWT0tQMz7TXHL_mFD2VD0F0aH1c5uUSVLVu5Ub1x5nn8Ocy9xEUFJ6fwZZyHGZ-EuWQH1TOSb5A4LD6AEUxr6R-rdAxREdnwSqDeVZWHn0_XS0AlLtWPdET5aOsWazJE1Fw9XWuIGGt982ojsFiLU0Xpjf6jMY3f3KW3ty_Vfd_91hWlBTHjFGdQFFeqOCaI77TEJKV0EBUazfuK4Dvm2x6xDJSCyiBwKrsfiu8eCEeHflv8KLMNh2OJ1dylvQKTbhKWFNJ6V2gcyQaTqHHRC2OrbraI6PH0KzG0H4mexAVthzppnE8_Kn_YqGTPdQMxHlWAHSoUmbjKPyC7vuJLhTFsFpG1dwRWJp2VfCAREBjXkkmeDYCv3wfYp7RXfK5tVnSXP70v5mDjEv1bYXIpkb3jSL4NlNg5q-rvnN3UN9hAsj48Z1d6N5rnA11H6GaqLAl5o4GZ5eBodNkRZX3hbiZV019-EiHaVK_pg6-5ruGa80Jl-dX7lDfGLNuJrfoOYfYAIT7cSaw1TNgI0qfVa6KdtJo_7c_E08jbbMkYJ62znnKeMWfIGzhloLNrKY3mlyvOfQieqxfGAMTFETddHIJj-sSim5RvsfG_67WYMRF8EyHdjfrX50rnezABj-iqHLwveVFcz3ENFFl87KdM68Sp1I0zgZRFjx1Q-piRtPTBmVQ9pw9o-bSmmMExeZdw0Ud1fmpP8wKoslHw8HiWBbPTRFqTc6RQmenwmUXcL2h4U6LceJigiilQfIVEy4T1lC6qfCHJw1ObF5kq-BV0-8HeCpx-F4mRM21uDwKMUCZ3Hc4fiW3iS9ja5DJ-pJgV-PL8In5_BpT0gZAdHh2p6Y38xidvluVdeR5tYYqgO8l2jKcGc4U4bG_KqJxVTCtoSDjtAr_98osbVshBEu7T6vOYpzu-hek-C3FwRzTAPxncSC3-M4quXijVX7Q6rLgA7lcccYwP74sxL_bZ7RvjKIYRzBCRSFH5HQ8d05Yn--Zhv_iVGz7xvPdOdJE3XN8lBDsAFyVr3eBN4qDEbitEaOgN-gsv__XELhw_fXQze3sHRopqRQC1nsdIDhTLq2ad4OCA7tSQ48TvoA8MqLj_fEeIVQUXFZ26gz3-dFdmS90nllr7m-Vp-YwbvtZSSeDJ580W825QzdPf3_R9GyY-Z2ULh11zhOzK6nV4t5jdJ_pupJFwxiilAz6rOdHCGKWwzjyix-c4mdhYqIck6vAAeNbkwnG5_QGWAmmkNQPM2Ex4UiohEnmavRpb4ml2ZBRa8rHeOcg8Xf5oxfFuFLK1e-fOzKluyUL0-c2AcXxPeFakTjNmYn6_7p_VKlcdgTtOQaB9rttnBbcBQ-DPpe11IYOKlUusF1qswJQWCOISUT_SGFG7fNWWWAJ3VH6EDuT1QMTq8t-QV5szKSTCQhwA00p3whgITW3sWWL6KFlG2tEatUdvbdJqurisgeFpvug6EuSJbNIT2yjDmwkwj19oan6jlnQmxAqOHh9IV_7JcNiQMnk_Mpcuz_MiCvQH5mI2E_VtGGwUT9xOXBZuTmrcmPaXP-HvVo99wFP6zqkG3doPmjrgIIuIVUI_7XNXvZyq3EFMsCVwnNI-kem61rg46csQGlNABLQA5iADTA4xvTgICvb-PhjHU9TKOHpvL5znhKargyioeVz10p1aoAuqnu1dnv6TXZq6usv00veEeMTqIMtPrWcpH8ISsnaI5LzDMYEHbGFmIp3Yx7zriW09n6KLU4HsrRiAK_xYXYPhLJsAE-jxFeBQo9HL7MglVyEsneDWz-sY7JiUEElll18rXn0A_iXgp-pMJjlAZy_kyPJUgf9kG9Codt5DcqI7LNbhNWUvMLCYpQXZB1WNbmuSH2eDRBm8ZtjYR5jF6k0WCNrVL7vZxtUNSCqUFyBZISPwyEiyk8tEB5Hp6mzTcKMhsy3xXKc_uMMKBSiSfGJJEpyB-TnJPY0SlqpQ4j5JNqypqSUDfRZnUJOs6m49KhKsbr2XCy8mH7dLx5jsFAnoEN1LipaDMZGHFV5Yq_8kitUZCTclFmw_J56Qhs-1-tnFrSV3BuyNlU_-FqZqArubb5UA_6l0-mD_C9jok8JL7gra4tEGW2N4BjQX7Sw7kqdA2-Tf4_IdqTQt7ALbSfbo1ktr2299_K8bdZ-e4ubgo24AiGW3S0kVJvE-6C2DHFLOyHTAaPmp85-Vx__Oy495NDdQWU1UIEHvUm3GmBsT5d2OCTClS4wDv4DMGEn_IdQ8ySlFsL5wSWBDnzXmDxBAXDLcDL52oV9U7CV1Lf9IRlJLOIX-3HrCJSniBUIHDvHWbKNUog8wllL7QUXmntRPDTyxVDR0oWqQHs-uqt9OG3uP4KQU2LpaLa9Y22ty-b-PT9rJ8N6oN3GpXbLs9OQEZqKpNvNjYYKwNzf0obVxxyfjk-uC2aRyOejIxNXzls5tDYOXXBQaViEKlvYrZCcGGQA7tPzyXb8PZOKVWRce0TZzsxoDXosTAc9W-teiKNX4yMxZcnkKZGmA7bs2CFXcAHrR6VMA_ikrPqvjEczDQNGM95xa46ItNG-urVHwn6f1v0AMthjJlaVyb4ZI3ytmPkBo3tFuEuupfCGZ9Y4HMR7HxhhlFVBJWb6YK8WfiNeiBbtXxsl8VnkUNEQI40AtSnTHHcPFlEpt_Bq4hs5MEl8IJNl_X6FqZghxmfig2-TlO8TrcfLxrRfY5z8kCcGj1BUtXlX7lTcXOQJuO0RZUymwrZJJCGGmijh0KKS1LV0hqenriBgPjFub6Ns1c2epr5fa9qmlAnuLl7xR8EkO1ZH8Hz57gfhXKrFW3QcAgUllR-EaTEAjGypkCNelbxReJU-oYChgqJYuie6-wYotVAljrimITgwQNs861I2x1TsCogZCe7zUM6cSbgxg9XPCJnbZ7Qw4yd35K74p-75ZYRhbrSwKR5ot5wVSwWD7Z6nVebTNStbPGqMnLfsQXlDYhEMPqtgExWyFdrsb8NGYxZieospJjGekShaaUpxIhBRHIYWzGcZ6OQLbm2u5cu9SySHLqJryQoBKFglGzq93c1U1Uy3Eb9ok2s58c8X9O3_Wqp8D0PoSOfcPS7STDohsdAh7N4vF6XdwBvZAbxSCx45ZGml2EA_-qmO8fSZXk8Z57lYzN8quMmYoFn0Ug-rHsna5yQeJO9DgMxEcvSToenQMELXY_XjaYjrlmmcNrP2xQTnDRDziE18jyiugdpsENSlXSGBxWkg9NtNgXG_hsE3kOhiFkl8mGeEcMUBzwgDD2V4_Vl68onx0SM_0qs0fITOyEASuq5_ZW7fKhZl3sMK7MqoLkeNKZeKyj0f40Fna-d4spv7l58bDUmTlgX0Z9RZBq9VoN0O_wXfIfgVdkJ6XyS93f9xm3-42v3RdYa52FS5GmgwHIVs3yb7X0zGoaWzrmHcsWI9SILuNTw5FT0MMKJOpuKGZLltCMA0ITNMW91xvW29PHSmojEuMx-B0fXHH-qyGnMEGbvvTssxiOmq7RWo2y5kLtQU28M-9KN-qzcGlstyxzH3j7B-7KUfsLgVu5qz2I-o1KeiS7Hl9dfnCpX41xAEn1OCBBpRZbJyMa7p4zoumsyB2O5feNbjHmyPbgl0DnUXyc5Hm2-7lHdciFzil-JRyGmjhBNvtYu-ysGcW0PEj8xsSuSSHiYW11dFq3MBW4uYAU-cckSqJd-dbALRdDi_BtqzmMDHK3mpJc3hkdp1OBohyivyIXm8No1yRyCjvc8DvzzwxhLMIEjvNbB-St9L-pNMLmXDgIZMTofx8EppwdtKxpxy9i4Mc0B2D806Twk04Xz_8_Yig0q5jY5TaTo2XUPEI50LTX9z4pcldCGgdeP94p70DGOxka-4193Tbj-OEJ01ZXCpB62alm_cedIyqBF8QCVrAVBIDaDy-MHeLLBWmPEoGuptCq-SNFjGObiwGx8CxzSis6s06rBZw5oD54LESU&cid=CAQSOwDICaaNquZZdzR9uyZZ7qWCDyS1972aSA7QWWQlDrqA_wJZcmZxOR9qBzcIw9nwCsfd0dgx2fw0FcnRGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fforex.alghtas.xyz%2F&ds=l&xdt=1&iif=1&cor=5757475013580904000&adk=2857193498&idt=327&cac=0&dtd=11

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b648cb10b96d05d057443cb9f2ead54a6b222a66fe166b604d2a1be37f70555

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38685
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame BAC3 39 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27409
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 5A0B 39 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27409
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 88C6 39 KB
15 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27409
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H3 200 view
ad.doubleclick.net/pcs/ Frame 24AB 0
0 51ms
45ms Fetch
image/gif 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/pcs/view?xai=AKAOjst9Ymzjl8SlWmAph2xLiEY7nyreXC1AsrUrek8XLPgi5tDIU_LrO3Fd4bKpoTI_J91uUrnHcdCbyUxPqpXdbZHp3OT-kW-aR3ZJaAxJBglvmgSPF9m5UXaVZcmY8m54aqKFG3fKXXrBjY9aKr50zRXwduesegi3PChBkPWAykSsxg2GhHl3fauk_N4RcImvhg2qWBEn8h04d8nof17YXGWSghlCnmzNnjUxN8JvciWXT7HjrvDRKI_L9T06kun41RLV7hiO8fwoAZ9UeyDpqvUxQyWznV6pyLS_a8bvKEwwFqkFtZ0QI-v98nnAUmKDx2sPu4ZGextnEa9wrfwd8T0F9F9zSuJWZHxMWibNXbXJI1R_pPf0xoVqRMPHseyNYOLk9BZ44MCs0m5UOJiI0-aMMEr7krn9l4eloKXVR3qeqQ_zuOUyN-iN9Rc78v4UcCw8i0B5zNIdbMkc1oBzpnzaPI1snRAmlawxSlJVGkboZKCKLLtqqO08ECO-skxfpvewpAA-XGnhQVh-nwc7f-SxVfvZyHph05BGTDXna4LmGunzIa71rbLQ_hzjhWWGWosrs-x-Tg3arO_Lcx-dh6d8CHQFchdR6TGjRml_xH_Sh60HDd4tzytJ_k-N1M7TiTxVLVIYIgspDe7_M1zJOnW0I0I0MMM3L2t35DIS4pgxhLp3XgjwSW2-t78TMwIlAfpfA6o69UjOfNgBEsiyYrrR4lAzNcQ2-0U8zTrr5aXoSR66noeSxlk927xcehvi72d7FXNgutRGWtCKeeQ_kyWm3FXf18IGIvm9YE6azHB18u2ovAvmELYhIYRf7CvTv79fbyyGyWVln1wxYXozYnifeTzbXOKRN3khxaH_3Cxc96UKQwP7lRPZOj6wwV0v25AuXuYGV0Ghb8d5Vr9pl5oIROdcRu2BZcLWCFTYBZ0RkiRYd-D2SVF_A9nXRgwxX7kKpju-Qx1j-mql7cUlSXo85grYv75RTRNRbhCaR6aCVDMjfXkN1tdzQs5ikExCUtW59KL0mz48W4l0EsKYGN4KexfvIYo_zl8g7waiUIH25MQ0fTk9r7LvzV1EG_kg9SYzHa2FXczIpdiAv7d3iVKTcghFFa2ObbcMW7tIHengFDqkjPRutLh-jcfquOQ7PnZGOMjQDnRwis-PEZ_2yQwcufzoEraB8K5SXoZoQGMEdjXXuY8eVHb7uqESaS-iB4uZG7x8knW1H1WcC4zlpFA9kMbV4QF7EU33zDXLz_-Fnhw2j2IrgxyZHy1ojwnFJ5ULZSQxc0PDKHXkY5PtfbR29tS3kWEtXHwq3-JvKZ8uH-2T-RnhtNY5fCggjRYv-xGgl853U7iQPPvu5gLdyRN3-MVPxyqdIt-JKb0SvoyBPN5JgI5s2XlS7LL3Gx88eZcVXBK--RyqGJ42iIoTh1XlI6qhV5p_s4n8XYT7OeoAaw&sai=AMfl-YRIRXXGqDTEtk0opFtxpEOtALoRF7xTvxQEgmiDdB56NdsSADK2JqPJmD0VyfO_scRJDo-Tgo9onwzdYeWdKoAxtSvJ5-klC9c3CDkcMVLxxsof3flOwr3TuTjRPKdmITL1N_jnkhIoh3WLNW31vi0fIWhcMZRLqIxyfxqN8fdV6gENvfhhMMMzLX5MPPlvewWumGxJj9PWWgIno0M7eYezwp_TlMFAkUseu9DWc_w1AAePxWVZNhGjZfo8id48BhV5IV044YvDzf9IvobUZXyLRdbaF38BwX08b6h-UcVXzRh_I2qe8uCrWw30bb-cqPxdfqvFJiyomA209OMFrEjLq1Z9L9bumK5WWcT7lic0_IlnozXQMivbAf9Hms84kE6HaWv6ZQqEJA3xguS1ZyfIFslfXS7cMy8nXC4vkiTtHgdqaQ&sig=Cg0ArKJSzLeIa0qOUMlZEAE&uach_m=[UACH]&pr=missingexchangepricemacro&crd=aHR0cHM6Ly9vMm9ubGluZS5kZQ&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=420&vt=11&dtpt=295&dett=3&cstd=117&cisv=r20231109.79622&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 1D82 47 KB
47 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:31:52 GMT
x-content-type-options: nosniff
age: 875
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 00:46:52 GMT

GET
H3 200 OnAir-Light.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 1D82 46 KB
46 KB 14ms
14ms Font
font/woff2 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Light.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:39:19 GMT
x-content-type-options: nosniff
age: 428
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46936
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:50 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 00:54:19 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 1D82 8 KB
6 KB 19ms
19ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fdbd418f02c536d4b04e4411ea09246c67a859c7b31fbc9742c5305ab890ba31

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5900
x-xss-protection: 0

GET
H3 200 60005582_20210507060843268_Asset_Transparent.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 1D82 2 KB
2 KB 14ms
13ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210507060843268_Asset_Transparent.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f741883eafc84067b80014e53fbfab2505aca4f7cf767b17404a291fffb79d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 07:44:02 GMT
x-content-type-options: nosniff
age: 61345
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2040
x-xss-protection: 0
last-modified: Fri, 07 May 2021 13:08:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 07:44:02 GMT

GET
H3 200 60005582_20231030031026052_Neutral_300x075_02.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 1D82 10 KB
10 KB 15ms
14ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20231030031026052_Neutral_300x075_02.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a9eaa2867d90c208cc4cde7402d0023b97dc30abcbfed1fe303194c4420a8ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:17:44 GMT
x-content-type-options: nosniff
age: 12523
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10583
x-xss-protection: 0
last-modified: Mon, 30 Oct 2023 10:10:26 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 21:17:44 GMT

GET
H3 200 60005582_20230831012251954_Neutral_300x075_03.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 1D82 10 KB
10 KB 15ms
14ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20230831012251954_Neutral_300x075_03.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8698d53751209aedd02dbe44175475604b8f7b0558acd20132e92d8b643e25e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:13:00 GMT
x-content-type-options: nosniff
age: 38007
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10373
x-xss-protection: 0
last-modified: Thu, 31 Aug 2023 08:22:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 14:13:00 GMT

GET
H3 200 60005582_20230831012244205_Neutral_300x075_01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 1D82 11 KB
11 KB 13ms
13ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20230831012244205_Neutral_300x075_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a097fddcd59bf24167b004c67516760b41d64594c1da03f7e4e0554637a2c83f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 14:13:00 GMT
x-content-type-options: nosniff
age: 38007
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11321
x-xss-protection: 0
last-modified: Thu, 31 Aug 2023 08:22:44 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 14:13:00 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 1D82 43 B
608 B 66ms
19ms Image
image/gif 141.101.90.96
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_PEF_HAV_14123_PV&mediacode=30520114_4307561_375826214_145344133_DIV1007A20230925&ref=30520114_4307561_375826214_145344133_DIV1007A20230925
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 141.101.90.96 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Sat, 18 Nov 2023 00:46:27 GMT
via: 1.1 varnish-live-2-0
CF-Cache-Status: HIT
age: 415129
x-cache: MISS
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: keep-alive
Content-Length: 43
last-modified: Mon, 16 Oct 2023 12:55:26 GMT
Server: cloudflare
etag: "2b-607d4eb83ab80"
Vary: Accept-Encoding
Content-Type: image/gif
x-varnish: 183737950
cache-control: public, max-age=31536000
Accept-Ranges: bytes
CF-RAY: 827c324f2d301c85-FRA
Expires: Sun, 17 Nov 2024 00:46:27 GMT

GET
H3 200 bubblespritesheettiny.png
s0.2mdn.net/creatives/assets/4085730/ Frame 1D82 26 KB
26 KB 7ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4085730/bubblespritesheettiny.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6063756018175705088/300x075.html?e=69&leftOffset=0&topOffset=0&c=ZB3y8Ls0nt&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:43:31 GMT
x-content-type-options: nosniff
age: 176
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27068
x-xss-protection: 0
last-modified: Fri, 12 Mar 2021 15:44:55 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 00:58:31 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame BF46 111 KB
39 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Origin: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 06:30:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65776
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 06:30:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame BF46 11 KB
4 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BdCuOijC4hS1TVdrS3KWE383eub3MNNfoIPnF0N9B6H6s0I6iimXJEmiVyB0dubT5PBOriG1tO8CV6WwO8yThnzJ86TTWzi2sxyLwPsz5mXo_gp9tpziKQJZfqtAp41iGr2XcHseBFvQGe8MBC_yZYPt3eD4ni_m0bVoin55Ooh4pCGj8&cry=1&dbm_d=AKAmf-AzLeQuCSH7bswG00BKySM2TzdtezcDztoGtTkvqFN0WPySy545CPg8jE51L4GEh2e8m8qDBxYe3KagoushsLyI7m_75xAKtJ1yV1zWT0tQMz7TXHL_mFD2VD0F0aH1c5uUSVLVu5Ub1x5nn8Ocy9xEUFJ6fwZZyHGZ-EuWQH1TOSb5A4LD6AEUxr6R-rdAxREdnwSqDeVZWHn0_XS0AlLtWPdET5aOsWazJE1Fw9XWuIGGt982ojsFiLU0Xpjf6jMY3f3KW3ty_Vfd_91hWlBTHjFGdQFFeqOCaI77TEJKV0EBUazfuK4Dvm2x6xDJSCyiBwKrsfiu8eCEeHflv8KLMNh2OJ1dylvQKTbhKWFNJ6V2gcyQaTqHHRC2OrbraI6PH0KzG0H4mexAVthzppnE8_Kn_YqGTPdQMxHlWAHSoUmbjKPyC7vuJLhTFsFpG1dwRWJp2VfCAREBjXkkmeDYCv3wfYp7RXfK5tVnSXP70v5mDjEv1bYXIpkb3jSL4NlNg5q-rvnN3UN9hAsj48Z1d6N5rnA11H6GaqLAl5o4GZ5eBodNkRZX3hbiZV019-EiHaVK_pg6-5ruGa80Jl-dX7lDfGLNuJrfoOYfYAIT7cSaw1TNgI0qfVa6KdtJo_7c_E08jbbMkYJ62znnKeMWfIGzhloLNrKY3mlyvOfQieqxfGAMTFETddHIJj-sSim5RvsfG_67WYMRF8EyHdjfrX50rnezABj-iqHLwveVFcz3ENFFl87KdM68Sp1I0zgZRFjx1Q-piRtPTBmVQ9pw9o-bSmmMExeZdw0Ud1fmpP8wKoslHw8HiWBbPTRFqTc6RQmenwmUXcL2h4U6LceJigiilQfIVEy4T1lC6qfCHJw1ObF5kq-BV0-8HeCpx-F4mRM21uDwKMUCZ3Hc4fiW3iS9ja5DJ-pJgV-PL8In5_BpT0gZAdHh2p6Y38xidvluVdeR5tYYqgO8l2jKcGc4U4bG_KqJxVTCtoSDjtAr_98osbVshBEu7T6vOYpzu-hek-C3FwRzTAPxncSC3-M4quXijVX7Q6rLgA7lcccYwP74sxL_bZ7RvjKIYRzBCRSFH5HQ8d05Yn--Zhv_iVGz7xvPdOdJE3XN8lBDsAFyVr3eBN4qDEbitEaOgN-gsv__XELhw_fXQze3sHRopqRQC1nsdIDhTLq2ad4OCA7tSQ48TvoA8MqLj_fEeIVQUXFZ26gz3-dFdmS90nllr7m-Vp-YwbvtZSSeDJ580W825QzdPf3_R9GyY-Z2ULh11zhOzK6nV4t5jdJ_pupJFwxiilAz6rOdHCGKWwzjyix-c4mdhYqIck6vAAeNbkwnG5_QGWAmmkNQPM2Ex4UiohEnmavRpb4ml2ZBRa8rHeOcg8Xf5oxfFuFLK1e-fOzKluyUL0-c2AcXxPeFakTjNmYn6_7p_VKlcdgTtOQaB9rttnBbcBQ-DPpe11IYOKlUusF1qswJQWCOISUT_SGFG7fNWWWAJ3VH6EDuT1QMTq8t-QV5szKSTCQhwA00p3whgITW3sWWL6KFlG2tEatUdvbdJqurisgeFpvug6EuSJbNIT2yjDmwkwj19oan6jlnQmxAqOHh9IV_7JcNiQMnk_Mpcuz_MiCvQH5mI2E_VtGGwUT9xOXBZuTmrcmPaXP-HvVo99wFP6zqkG3doPmjrgIIuIVUI_7XNXvZyq3EFMsCVwnNI-kem61rg46csQGlNABLQA5iADTA4xvTgICvb-PhjHU9TKOHpvL5znhKargyioeVz10p1aoAuqnu1dnv6TXZq6usv00veEeMTqIMtPrWcpH8ISsnaI5LzDMYEHbGFmIp3Yx7zriW09n6KLU4HsrRiAK_xYXYPhLJsAE-jxFeBQo9HL7MglVyEsneDWz-sY7JiUEElll18rXn0A_iXgp-pMJjlAZy_kyPJUgf9kG9Codt5DcqI7LNbhNWUvMLCYpQXZB1WNbmuSH2eDRBm8ZtjYR5jF6k0WCNrVL7vZxtUNSCqUFyBZISPwyEiyk8tEB5Hp6mzTcKMhsy3xXKc_uMMKBSiSfGJJEpyB-TnJPY0SlqpQ4j5JNqypqSUDfRZnUJOs6m49KhKsbr2XCy8mH7dLx5jsFAnoEN1LipaDMZGHFV5Yq_8kitUZCTclFmw_J56Qhs-1-tnFrSV3BuyNlU_-FqZqArubb5UA_6l0-mD_C9jok8JL7gra4tEGW2N4BjQX7Sw7kqdA2-Tf4_IdqTQt7ALbSfbo1ktr2299_K8bdZ-e4ubgo24AiGW3S0kVJvE-6C2DHFLOyHTAaPmp85-Vx__Oy495NDdQWU1UIEHvUm3GmBsT5d2OCTClS4wDv4DMGEn_IdQ8ySlFsL5wSWBDnzXmDxBAXDLcDL52oV9U7CV1Lf9IRlJLOIX-3HrCJSniBUIHDvHWbKNUog8wllL7QUXmntRPDTyxVDR0oWqQHs-uqt9OG3uP4KQU2LpaLa9Y22ty-b-PT9rJ8N6oN3GpXbLs9OQEZqKpNvNjYYKwNzf0obVxxyfjk-uC2aRyOejIxNXzls5tDYOXXBQaViEKlvYrZCcGGQA7tPzyXb8PZOKVWRce0TZzsxoDXosTAc9W-teiKNX4yMxZcnkKZGmA7bs2CFXcAHrR6VMA_ikrPqvjEczDQNGM95xa46ItNG-urVHwn6f1v0AMthjJlaVyb4ZI3ytmPkBo3tFuEuupfCGZ9Y4HMR7HxhhlFVBJWb6YK8WfiNeiBbtXxsl8VnkUNEQI40AtSnTHHcPFlEpt_Bq4hs5MEl8IJNl_X6FqZghxmfig2-TlO8TrcfLxrRfY5z8kCcGj1BUtXlX7lTcXOQJuO0RZUymwrZJJCGGmijh0KKS1LV0hqenriBgPjFub6Ns1c2epr5fa9qmlAnuLl7xR8EkO1ZH8Hz57gfhXKrFW3QcAgUllR-EaTEAjGypkCNelbxReJU-oYChgqJYuie6-wYotVAljrimITgwQNs861I2x1TsCogZCe7zUM6cSbgxg9XPCJnbZ7Qw4yd35K74p-75ZYRhbrSwKR5ot5wVSwWD7Z6nVebTNStbPGqMnLfsQXlDYhEMPqtgExWyFdrsb8NGYxZieospJjGekShaaUpxIhBRHIYWzGcZ6OQLbm2u5cu9SySHLqJryQoBKFglGzq93c1U1Uy3Eb9ok2s58c8X9O3_Wqp8D0PoSOfcPS7STDohsdAh7N4vF6XdwBvZAbxSCx45ZGml2EA_-qmO8fSZXk8Z57lYzN8quMmYoFn0Ug-rHsna5yQeJO9DgMxEcvSToenQMELXY_XjaYjrlmmcNrP2xQTnDRDziE18jyiugdpsENSlXSGBxWkg9NtNgXG_hsE3kOhiFkl8mGeEcMUBzwgDD2V4_Vl68onx0SM_0qs0fITOyEASuq5_ZW7fKhZl3sMK7MqoLkeNKZeKyj0f40Fna-d4spv7l58bDUmTlgX0Z9RZBq9VoN0O_wXfIfgVdkJ6XyS93f9xm3-42v3RdYa52FS5GmgwHIVs3yb7X0zGoaWzrmHcsWI9SILuNTw5FT0MMKJOpuKGZLltCMA0ITNMW91xvW29PHSmojEuMx-B0fXHH-qyGnMEGbvvTssxiOmq7RWo2y5kLtQU28M-9KN-qzcGlstyxzH3j7B-7KUfsLgVu5qz2I-o1KeiS7Hl9dfnCpX41xAEn1OCBBpRZbJyMa7p4zoumsyB2O5feNbjHmyPbgl0DnUXyc5Hm2-7lHdciFzil-JRyGmjhBNvtYu-ysGcW0PEj8xsSuSSHiYW11dFq3MBW4uYAU-cckSqJd-dbALRdDi_BtqzmMDHK3mpJc3hkdp1OBohyivyIXm8No1yRyCjvc8DvzzwxhLMIEjvNbB-St9L-pNMLmXDgIZMTofx8EppwdtKxpxy9i4Mc0B2D806Twk04Xz_8_Yig0q5jY5TaTo2XUPEI50LTX9z4pcldCGgdeP94p70DGOxka-4193Tbj-OEJ01ZXCpB62alm_cedIyqBF8QCVrAVBIDaDy-MHeLLBWmPEoGuptCq-SNFjGObiwGx8CxzSis6s06rBZw5oD54LESU&cid=CAQSOwDICaaNquZZdzR9uyZZ7qWCDyS1972aSA7QWWQlDrqA_wJZcmZxOR9qBzcIw9nwCsfd0dgx2fw0FcnRGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fforex.alghtas.xyz%2F&ds=l&xdt=1&iif=1&cor=5757475013580904000&adk=2857193498&idt=327&cac=0&dtd=11

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:12:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30824
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:12:43 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame BF46 31 KB
12 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 16:03:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 31361
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Dec 2023 16:03:46 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame BF46 41 KB
14 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 22:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6737
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 22:54:10 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 1D82 17 KB
6 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Sat, 18 Nov 2023 00:46:27 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 58DF 1 KB
643 B 8ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 11374
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Sat, 18 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame BF46 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7f1af0c6c916ebd2a9d558361567be79dc9ecb2f7d4ab0bb62defcc7498fedb1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6993610142221704340/ Frame D92F 259 KB
56 KB 9ms
8ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6993610142221704340/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6313ccc040c5c11bd9bbcebe132481116d8e5a0a324549bce70513bcfe760d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 209164
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 57688
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 15 Nov 2023 14:40:23 GMT
expires: Thu, 14 Nov 2024 14:40:23 GMT
last-modified: Tue, 14 Nov 2023 15:28:04 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame BF46 0
0 75ms
54ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvg202VWUqqvtVdrykjJHJS-o73efjT01H8S2L2IRqF6vltn6r7qogR5H32ADnRV3dAUvZBBc20c2nOwq4dWe7F6J_MM9pbjVSOW166bsS7EMV_36pNaYnARoeCCDzo8MZx2gUfrydeu0EeXYj2p-mYH-3ofiKFFmy_ntEWfEn95wBx6VIlG022qEk4TK-ZKZueSBxJdSYlUPQrQsvvxqVmKryoU5eX1GxK-O7WLsvpC1oyINt9AHejMA5I0IXlCv7_I9Fr76zuKOhCr3exMCz19LPcAA0Cn9uSghwtl3vc8_dC-ezYhkFqg-ius2SBd6SQjSkeAAuHZXsjt3Ym_7qS3xnYxLD6Wdn5__y2suhQVHVeTtIwb7ddr8_Zj7vPsyyhmyqYPBmexWkejCZXtbo9ZFPRfK0OpK5zQT7h-4m48AJCppMk5bcNG7nO0iqQ9OKgAxaiqf1-PjfBeu15thoxr9R3Iv7n0lhpOaNvYhSuAbokYYp34vRGHkP3YxhAJWQDbo4ySV6jhCIIVrV-O6E0S_91K0htHoWH7UW24QMkGjbdLEqXbhSkKIEqW0iYX35A7ykWAaxsCVSpvCChHgyqmC-AAFOpuM-Ocl12w9aXwe9PzAqKC60a71-IxIvW77bTfoQSSEABkGoqdV6tAhurM5aaEbO25uless0rZA2cTjM6zA3Ddu7Hz2Om8lPEvDuKPkegtqBuAbp5H1ckEaOdouB9RxHQec493N4vr1qnWb-27zWST5T49w2H2EusK2AWV3AHtJ1imJOTn5-tXoLZaExJHde17uhKnYw24Wy_072Csufj_WkWVC2k8zbXmmDI1AakIKAHCnxPk-2fFsra1s9oyYtuT_UNOU4RCkGXO8OW6Km2BksxnFAIm5-MuiXxKC5xI0kF51THmeXTRYoCHsSErip72tOfy-LKeAIw9PJRWly52ID4UOHMn1ZMeT0DLwbIW8AZ0uGlkplHL0N2IFc3MkpFt7H0dMKMhzSORTaY4Y0bWe-YbWTAfjKsMqvW5zwe_MfnEJMb_EPK2IX2cXP0-NIM_3RCzfL0f1EdugqBolkNdc6Ad2kF5zmsV1U5TmnbEreFKcvLQ-uX-LeBlpwb7Yma40P_RpLtCneu8BNMskh8R4OfPXYdbs8Vf4Cv5VUcO7nqvKLZ8GPfggTtOF0bXY87ulLUWXDsu-IB0xU4YBTvgNEJJeARxhJKOfzG2B98QV-XZJbyUnEpvVjVqAM6EiKaQ13qwiMCZ2DP9xENr37dBxIImDcTcOKLPR_1SVVJsJEAfjLdrdhTiGdVc1GIpUQi3BJBbsLEnYLPMpmluSpnsTTf3FjFIMj3_ytRQKXr0wAcyqjRufJLITY99i33sD9KGiru&sai=AMfl-YRplKyRjajhTdttniYnl49LdxLuGw2MVi6tDkO2sV1PLVE_oGMOQOGWfIrOLPUI2ASzc-B3XS_xhkNRy3EBdcVZ3bKieyXTsmdof4tx1bLvP9d9Vv1JyXoIR43lTkdUZlwkq_aoHS2r1C0Arlo12cLFc_NESsB-YRH3ibkiuLeRTPNpJxnQWlQOnqP6ACC2kNaVHT5yehcpXbu9DWe4oxwKrkSHbgYnpIJqpHNkOUnyFC19pk6h4k4Ran8-Q1tdEamI&sig=Cg0ArKJSzOCwbOw8Uo2HEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=100&cbvp=1&cstd=98&cisv=r20231109.76635&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Sat, 18 Nov 2023 00:46:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 170F 39 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27409
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H2 200 i.match
a.tribalfusion.com/ Frame 58DF 43 B
523 B 178ms
176ms Image
image/gif 2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.tribalfusion.com/i.match?p=b6&u=CAESEH0nlOLC25XEQZX8M7mj29Q&google_cver=1&google_push=AXcoOmR1cKY4ij3feDR8Hl_MBBHUCrW4rtuMldjhmNi1TMNe6kKTs0NUAXx4pN7B78r4PoSf3T6yN5z6yla5-4btOH3ZBCph9imV7g&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmR1cKY4ij3feDR8Hl_MBBHUCrW4rtuMldjhmNi1TMNe6kKTs0NUAXx4pN7B78r4PoSf3T6yN5z6yla5-4btOH3ZBCph9imV7g%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 827c324ffd63199b-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 58DF
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESENHjpBts6tzqS0UQix07cNQ&google_cver=1&google_push=AXcoOmQ2a1wcWAxERaLqdolKDCT1kI38WDc4n8vSP6uF5xttOgjzf-OfmMoBNzXKlVpN5R86wY_wC41Pjk35JUdOBqEW7ceQmSYM
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmQ2a1wcWAxERaLqdolKDCT1kI38WDc4n8vSP6uF5xttOgjzf-OfmMoBNzXKlVpN5R86wY_wC41Pjk35JUd...

170 B
188 B

19ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmQ2a1wcWAxERaLqdolKDCT1kI38WDc4n8vSP6uF5xttOgjzf-OfmMoBNzXKlVpN5R86wY_wC41Pjk35JUdOBqEW7ceQmSYM

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=A9010D608AC14006BA83623780E34028&google_push=AXcoOmQ2a1wcWAxERaLqdolKDCT1kI38WDc4n8vSP6uF5xttOgjzf-OfmMoBNzXKlVpN5R86wY_wC41Pjk35JUdOBqEW7ceQmSYM
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Fri, 17 Nov 2023 00:46:27 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 58DF
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEJmL_iWj95fsjFtwQ0zoO8g&google_cver=1&google_push=AXcoOmQ3wW_LJzaotUWfXYsb8t_XgDVu5VsLqhB5nHLTn7EnS4ZFfFdkjP2Enkjtvg4nhW3hzR3dBEYcKbF96ZPOqJhcwuw...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ3wW_LJzaotUWfXYsb8t_XgDVu5VsLqhB5nHLTn7EnS4ZFfFdkjP2Enkjtvg4nhW3hzR3dBEYcKbF96ZPOqJhcwuwBd9Qq&google_hm=eS0wUnZFY2ZWRTJwRVA4bX...

170 B
188 B

18ms
18ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ3wW_LJzaotUWfXYsb8t_XgDVu5VsLqhB5nHLTn7EnS4ZFfFdkjP2Enkjtvg4nhW3hzR3dBEYcKbF96ZPOqJhcwuwBd9Qq&google_hm=eS0wUnZFY2ZWRTJwRVA4bXNzOGxvNHdYUElZODBacTFEM35B

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sat, 18 Nov 2023 00:46:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmQ3wW_LJzaotUWfXYsb8t_XgDVu5VsLqhB5nHLTn7EnS4ZFfFdkjP2Enkjtvg4nhW3hzR3dBEYcKbF96ZPOqJhcwuwBd9Qq&google_hm=eS0wUnZFY2ZWRTJwRVA4bXNzOGxvNHdYUElZODBacTFEM35B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 58DF
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEPznie5XBCk3pmUdkDLP5T4&google_cver=1&google_push=AXcoOmQQ3chq9qmAMI7lkQ8k9P41YDtuosJ0vcWsbX6Ely-k1l2PZoT7zivU7T9oIx4mn4OGKZttIpxmQrWmhwf5_lfE6xk...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQQ3chq9qmAMI7lkQ8k9P41YDtuosJ0vcWsbX6Ely-k1l2PZoT7zivU7T9oIx4mn4OGKZttIpxmQrWmhwf5_lfE6xkMZ33rIQ

170 B
188 B

18ms
17ms

Image
image/png

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQQ3chq9qmAMI7lkQ8k9P41YDtuosJ0vcWsbX6Ely-k1l2PZoT7zivU7T9oIx4mn4OGKZttIpxmQrWmhwf5_lfE6xkMZ33rIQ

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmQQ3chq9qmAMI7lkQ8k9P41YDtuosJ0vcWsbX6Ely-k1l2PZoT7zivU7T9oIx4mn4OGKZttIpxmQrWmhwf5_lfE6xkMZ33rIQ
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 58DF 0
12 B 16ms
15ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jpu28U9Bf-qoZFWmFoFk8wNOLq3o8zF_NHtNsCKblqUfO3KGL0

Requested by

Host: 599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
URL: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:27 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame C3CA 38 KB
13 KB 12ms
11ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 122502
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Nov 2023 14:44:45 GMT
expires: Fri, 15 Nov 2024 14:44:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame D92F 32 KB
11 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6993610142221704340/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6993610142221704340/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 21:39:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11202
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 18 Nov 2023 21:39:45 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame C3CA 39 KB
15 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 17:09:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 27410
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 16 Nov 2024 17:09:38 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5A0B 0
21 B 44ms
44ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B3ntrYglYZefnHqiR7_UPjtOgmAEAAAAAOAHgBAI&bg=!y8ilyIfNAAZxrfrxUa07ADQBe5WfODMq1ovoWDQN7eBnrQ69nq49FByOze6dFC2j67OGNUtGORDfuO1sA5O2dMiq0QfwAgAAARRSAAAAAmgBB5kDBYtfztHnOlc0G96-3_FLp1ifAdNZArmLtj94jEp_QHZe-UMya7gD6Gw8NMmvITAZq5hrRAlzyS5p4ZHlGZWAFtqCcVQ7-_bKGTl5LtriSEmnRsFey0ZFhpNaelf29kCpe75Ix6O4Yi1-XE5pb_ClyIVSIbzGUrQtKNoegd-O_Xkq_q5xOAS5BF3bwgIl0UUTmZCwF45pqF7vfvbo46VCgbb0JhwOHi-hLtJFeqcViQe7TLBPDQVA5idN4tVM7DBtauyxWec9SwcjCxlJ5deyg5XDq0NniZcRS7AS7rlzuwdQGmUPzUaoIn6qPVGZ6Nhce5uxEL2prnTedhhRESNjYDlYVlfnXZ8XOysazQfhtfg0Dqfu0tvEtFr__0uvf7BTewDOSyCWJqlYHQYKjDm_zh-vXBGXrpWJ5b_vmQ9ZHXNHCnMm1l3fo5ef8VvqtAS33mbTEdk-7pMXRn9vOD6Qekf-Aqb8sNuOj7ll6CaeaNBjTBGW27dE49ixHhs1956evs1rgMqQSiZXfcmSvhjxNHZO0ZfC1E_WyL0pvvbvxzWcyAPdkNtq1BETUGzXZ0nbA7qRclOgQf5_UFkEpWaQIY9UmoUmcEXODJhgY__UJ8Yb2pjfrzQoTnNevzvWs37Zf2tpl5_IzqQ0yB4iFB4opCRp1YjROh7ENg01SxRDaMJ1nAQXBq5JhGUawLeykiXFpRSeZBlNBDqIIxZVtP0juGrtwiLBrlcqQtHOzsDkfkQT7e23Q_DF-5sXSK2xklXNAkUFJDY9YBWKsUnm-DvEHVmuFIoSagQqS77Cxiw6ckiPl7uAkb8sJNjCjoO06x6oCOw8G5RUxeis4cuBqu2wjxfBz7mNRz8YoFSjoaAx0_hEwyySLReOkrbE_eNfU_k4KJxsbGSRf76xQ5G3PcvqyVRAfvg1tcz-KKcY1BoWWiq9psbyxq_yXCOyn4NvK5IzP0HNQ14o4ecmQ1JOQUYx0j_YwCIGnsWcITor9KHk491A9sZuNUsXWfQIL9_FAbY6puFKOFEr

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BAC3 0
21 B 45ms
44ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BrVpAYglYZebnHqiR7_UPjtOgmAEAAAAAOAHgBAI&bg=!e3ileDfNAAZxrfrxUa07ADQBe5WfOB5vLM9ZgG6OlM1eIAhbZ8OJ3cadosL3HgOJd11P1GoG5qvTG5JMQaqFTsUZuVvKAgAAAUpSAAAAAmgBBwoADnrR7I1-uGGFm18b-8wkmQMHM5N12SYUCh-06pYDl21GoaYbiBwfsSo3XLtlriFSWHoyDKyeIwMvSofAQc_D1qdomNAn5gtu0vzYq4UcYQmNXmOsdkKJWLhserrwdEyF2QNzLlhET_akLNVRloJc8T-9UuhDdJYnDmtXdYWteiaiNe_0Tm5FBZbRygEVgvZvaYB8guL9NIFcTkU0ClWsEzzXAMK4F8GW6iUM0KtPO0SD2ADJOHOsL0PtjutjhciJ130xt6mRLo5wAq8I9QnZoH3aR1LLsC6c1sZ6on5xpreExOKhtQuJQectkZAYRKyjauZZAp0KjxEO6qoVScvyQuLXzMSTxDI-M7bwqfudih1XV9539uyt-g2ZSp10a4nhE2bAhFqkm4h0t_7m3a63lGvFY2uwPhw_UoLUU49aonze2d-ifw5p_RklIerqgKY38MkMD3AZteEpHyM0C4VUkC1mYnz2RlVqUU1J5DBrrhyRvMQbq1pYs3jvfE0yWkyYVHZvXWrGD5EKR2N3OKhv_MnUOFxVcrQEfuB2REiaqEFHg8qenglo2BYtPMQOjfSS0eOXIl07vxsIN1-wNA9fufYf7CllDdg2VxTSRYfEj_nb5taKbVElP41AdY__MXmCnfBNUi1MyrKPZTzflAEypMKxtxGNcRcpOkltd1uwB3MAScbe98OMUTivZgTJ0VUgK-UyVsIuQ-AQrPliw6V-YyS2ul7cx_t8gmuKMYjBc2gMzlsgesPkGz6h2QuDibYU9cnVxTRWaDl3rTvCWHHDW1f_5PDITfqWqHUHOyc5338M330stl1gO0xDeJcb073kM4f_V38ufIhIAplhUSxQ0EMG4bB4s6LPD80_4NHozv6Ju_UHhPw1iqQev1nRZw9dupwquqX0N8as9caLRZz7kSI7XDM0FwDraJztzwItsqK0kMfRw-1YwnJzMPZr5ZEL4VjAFXum3n0dAmswpiOUr4K9tonKdhPGtk-fTv4QvFIhIV9T3xDXnaVzErCixhD6jmfDuLqPvLifouhf74SDaVZyc8UKHTmEdA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame BF46 0
0 48ms
46ms Fetch
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvg202VWUqqvtVdrykjJHJS-o73efjT01H8S2L2IRqF6vltn6r7qogR5H32ADnRV3dAUvZBBc20c2nOwq4dWe7F6J_MM9pbjVSOW166bsS7EMV_36pNaYnARoeCCDzo8MZx2gUfrydeu0EeXYj2p-mYH-3ofiKFFmy_ntEWfEn95wBx6VIlG022qEk4TK-ZKZueSBxJdSYlUPQrQsvvxqVmKryoU5eX1GxK-O7WLsvpC1oyINt9AHejMA5I0IXlCv7_I9Fr76zuKOhCr3exMCz19LPcAA0Cn9uSghwtl3vc8_dC-ezYhkFqg-ius2SBd6SQjSkeAAuHZXsjt3Ym_7qS3xnYxLD6Wdn5__y2suhQVHVeTtIwb7ddr8_Zj7vPsyyhmyqYPBmexWkejCZXtbo9ZFPRfK0OpK5zQT7h-4m48AJCppMk5bcNG7nO0iqQ9OKgAxaiqf1-PjfBeu15thoxr9R3Iv7n0lhpOaNvYhSuAbokYYp34vRGHkP3YxhAJWQDbo4ySV6jhCIIVrV-O6E0S_91K0htHoWH7UW24QMkGjbdLEqXbhSkKIEqW0iYX35A7ykWAaxsCVSpvCChHgyqmC-AAFOpuM-Ocl12w9aXwe9PzAqKC60a71-IxIvW77bTfoQSSEABkGoqdV6tAhurM5aaEbO25uless0rZA2cTjM6zA3Ddu7Hz2Om8lPEvDuKPkegtqBuAbp5H1ckEaOdouB9RxHQec493N4vr1qnWb-27zWST5T49w2H2EusK2AWV3AHtJ1imJOTn5-tXoLZaExJHde17uhKnYw24Wy_072Csufj_WkWVC2k8zbXmmDI1AakIKAHCnxPk-2fFsra1s9oyYtuT_UNOU4RCkGXO8OW6Km2BksxnFAIm5-MuiXxKC5xI0kF51THmeXTRYoCHsSErip72tOfy-LKeAIw9PJRWly52ID4UOHMn1ZMeT0DLwbIW8AZ0uGlkplHL0N2IFc3MkpFt7H0dMKMhzSORTaY4Y0bWe-YbWTAfjKsMqvW5zwe_MfnEJMb_EPK2IX2cXP0-NIM_3RCzfL0f1EdugqBolkNdc6Ad2kF5zmsV1U5TmnbEreFKcvLQ-uX-LeBlpwb7Yma40P_RpLtCneu8BNMskh8R4OfPXYdbs8Vf4Cv5VUcO7nqvKLZ8GPfggTtOF0bXY87ulLUWXDsu-IB0xU4YBTvgNEJJeARxhJKOfzG2B98QV-XZJbyUnEpvVjVqAM6EiKaQ13qwiMCZ2DP9xENr37dBxIImDcTcOKLPR_1SVVJsJEAfjLdrdhTiGdVc1GIpUQi3BJBbsLEnYLPMpmluSpnsTTf3FjFIMj3_ytRQKXr0wAcyqjRufJLITY99i33sD9KGiru&sai=AMfl-YRplKyRjajhTdttniYnl49LdxLuGw2MVi6tDkO2sV1PLVE_oGMOQOGWfIrOLPUI2ASzc-B3XS_xhkNRy3EBdcVZ3bKieyXTsmdof4tx1bLvP9d9Vv1JyXoIR43lTkdUZlwkq_aoHS2r1C0Arlo12cLFc_NESsB-YRH3ibkiuLeRTPNpJxnQWlQOnqP6ACC2kNaVHT5yehcpXbu9DWe4oxwKrkSHbgYnpIJqpHNkOUnyFC19pk6h4k4Ran8-Q1tdEamI&sig=Cg0ArKJSzOCwbOw8Uo2HEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=312&vt=11&dtpt=212&dett=3&cstd=98&cisv=r20231109.76635&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: forex.alghtas.xyz
URL: https://forex.alghtas.xyz/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 88C6 0
21 B 44ms
43ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BpB23YglYZejnHqiR7_UPjtOgmAEAAAAAOAHgBAI&bg=!6uml6abNAAZxrfrxUa07ADQBe5WfONBLKINekjBuZiUBDdRIO8suhAp-b4yWk7PKDXfVasXbriqpVHQ4iY-zHdsYnSH1AgAAARRSAAAAAmgBBwoAWfU8_pjvPnBBqwq3XM3OP0AwYBFoOkxcwdiYfmRs7KzKGWvnwkUQqGl-8H2S9f30wPCQFkR5gEXLieAiWJQYJROMkEx4X9XzmihkKZZv-4fsFHAG6sV939-TmQL-lcc7XFWAW8A8D7joTrlxXc2zsg6CtWH-ArxrfadjXfJLLm89pXLNEgOV7-WY808KdXtYPmqeQrXmsTi18EvTTPGEYAt0Gj6L2HSJtdeFu5pUdH-f17eVn81WfXJVSvvu_snr9iBo_Vjq6mX3itFcAXzVeoexMsbn9vJkBfbTa0zsVLx2yCjeppp4LGdjP6q-MiJVfIiLysTjoem5v_6j7az-R59OhHeWwR8HQUjPQC6FUTIQWWPnWnUWdFBJlndXP9HRPdnFuZwTaqTxFZ4f6vF8IKZ5ZeH4c_Jca8b4DZT0O8ShLVztc2JQlnHvTXDliPNlfjtooP879P92wJr1l_kWSdkFIRCkDsNeAbToRVUZT1ssvR5O6hGrP5A2RRDJxjAlgarerk8q08Rw9Q5jGgVHzdidFbkEXQMZECwNsWKqbp0VlXhFdPBOUKMcOUGRbqqh_YAU-iLwpCr9XGgdRJdQxtrXfD6Igu71fgvHHv4PI1QS0PiycIIkjAvJ40vKb5TYGrRMjqbcBPyqq5HvcY5LC-15ISo2nNERSkiQEAudXfsc8F-QXyagMISGNbsY0EOVJAo89BYqoQKtxUk5-YfoJVuuRi9DbRjcJmbTG757p1kGuZTqay5DSscZLT7kP2TroTzmlhShdBkEKV-WfZnzyQtcJ-hEGgZp0Plk_vbXqDdXap7Pla-hgG9tOBOYKWquzPYt0impAI_6GNnjRE7fzsZLrHlVDB9nx5t3ITIbvhuNBpHWc0x7QE3YXdZxeTuMCfAvgZNUYODN4fNLks9LP6BthNPhstWNvU4iBia9bhckFV8bgqAgSZhZ6s4KuSc-5pkKSk6syxCSo7oqD8n0CJZsA-GsjQaV1itV32s11Lnpcsv3QYSr2ob1i7miZrmpekMAjzPrFs4JerAW0ug_NWgSMjy1ijw8bbnxlUgcdJkD5HrlZJoC0ntG2TeDjM4luT-XQRwiQfvD5F7CHbvSwhN31GVaY5nZoDu8zYdb5qrmbz5DCdnyuH3GnQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C3CA 0
21 B 43ms
43ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BYaXFYwlYZYawJK--9u8PhI2w8AoAAAAAOAHgBAI&bg=!b2ylbCPNAAZxrfrxUa07ADQBe5WfOOacD6QHvhY-g4Ds7-fbXeJRw-Wrpo8Duh_HJjdePJXcfbje0kVQtIkros3vqnOrAgAAAJtSAAAAA2gBBwoAbbgJr_tupEo8_ZJjJmP0LNiD24W8uOPyLtgrzJrMwgC0TS7LPi_5Bdx1lQTK9936FoAR3sO24JjkVTfkLi7MxkvNSYZHER8EbX-bsrukH27bPxZqdUMx_mDgoGPzr9OG9O7xOW23ZlpnSuXqzoCZAxG6w6rs7SZjWe8vazpr9AJ9BaS1L3iBp_IKA8WjrlLK0V1Di4q9BuzR18G_f9ZQF-l0DwbqdcbqsNwY_pZpWBi08XB9OJpGLihygQyTQ0BmIbQbvwasL-YgHBNRPKqKWwn7k6Y6ixoPKwmERj_s9M2w_IJ_Y5IzMQYyX0_fUUZdCYSUaKWqRil-EABTMFZvIzzkv-axsDcOdNn8bQtoQwRTM_QSJYnH4c3DRL-PZ1Si4Exxf64bZrM9LxdAlA_nTtP8CqQEmLnG-TwD2R0fQu-O0o-ZcqxPG512kKrNsSFlzBjafSxRJAD1vEAwlRbUZdxEPQhIAu9VPyYbBn-e_75OI0YlD19KwjmlbRpGYcLtcsRzvMSvskY8l7mPVSL6wwq0PPyGRnV66Gs70NlPx9zEmFBT6rreeO8AHfIYO9Y6slrXn_n0BcHrbmM0OffKaE7RzrGSbamlTdbxVUp8_34t0F_nZpsVRQQHv1w5kUY7OpbFWI0tOOK-XNCsEU7Bt2CLWy4aeg4nNb_4EqImKHLvQ0W9a2omp6cRJxhszj9Ul1x2mpShiJ02C3KxjfnFkk4eEmU2MyEgXyBoZRFu52bsiGy3sdFdp7PecW6PC3sLpl03yWFO4owrsGXE8yvpr106q7PiOVuEFkCaDF65W_BI-u8_yDcQC6o9UYt0o5RYFgYlQY9uF57LGHxlYu5By7gMZZc_I30z-PiwIzJDanM-2dBtOrsTyx6ntSErBG0PcZ8unxsb7kb9E-gynsi_ZAy63KPVWVzzQj3vSq3xgedMN2uv4qb6la2KzFcm6586VMjGBWgg_nzAU7qO2WqCswrl5I9Maw7x0rXH9sGoagOwesfLFoQXbHjeJuAJZrhvyY0nll8dWu_LfyD1NkaQTOl5m6l93r7EviuamsQ9unpRW_mJOjHVpB_b82CBVpstGMyKnWXOnyQPrsFScZAM8nFDUnYoEbIvzvsFx5OCg8a1H6uVivL9uLrrtwrfacdr_iWOAXJh6d_DDKnfTbq8JcGHW1RQdQrNWqlECMsiv8ZR3w

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AA6B 42 B
64 B 52ms
52ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuJq-Nub1xHd9sNe3AEWwdSGyGMr5auxBo9L3HFS22AB9VlznTI8R3xixzaYHKbtayVHhqeheJY05-8BhoKGvi1dnU2rOs3r40u3gqtxHfOvLxaE44GOvRBaohBR7fhukkBUyUHsjIDqEnC&sai=AMfl-YR5mLqlxbDDuR_C5ChMec_UqMhLThJiGVxzZAFzgAEfOaNZxXrNhnfGaRO4PiFlShCRElqSZJ9S5yBTHRL43uCEHhkPUBObN4FzNXLJNewm9IajjM4E4nMrboA&sig=Cg0ArKJSzI2F1fnMtZt4EAE&cid=CAQSOwDICaaNquZZdzR9uyZZ7qWCDyS1972aSA7QWWQlDrqA_wJZcmZxOR9qBzcIw9nwCsfd0dgx2fw0FcnRGAE&id=lidar2&mcvt=1000&p=1110,436,1200,1164&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3658310432&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700268387018&rpt=382&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1514 42 B
64 B 62ms
62ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssNBMI-T7Hjk69KOKI_kgh8NcDWWnDStWraztBswE6D-upI5QwyDGfE1escG7ICzFvCMZudFlHbdQrpEEyHsXo_KpEoQ28jUg_1vN3KNf5JdoOVbc_QVXqEiAaalhs1q7N9rvM2twa5yuLz&sai=AMfl-YQu0oE_wjeGAuxEliUY6X6XsdAB-lnpG7z-7D5nEiGfR0x8qR4WIFV-J3EVMfa5LlspCniorcknvOmHFzT_ywsfx06UsjxWvpJyyt7G7WcplCOVbmj8RX67ERw&sig=Cg0ArKJSzBTZdU5tnOPXEAE&cid=CAQSOwDICaaNquZZdzR9uyZZ7qWCDyS1972aSA7QWWQlDrqA_wJZcmZxOR9qBzcIw9nwCsfd0dgx2fw0FcnRGAE&id=lidar2&mcvt=1002&p=0,436,90,1164&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2126799684&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700268386974&rpt=369&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 8E28 42 B
65 B 54ms
53ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuPYoh6McVb2afXjAMTs6WK5RtNKpcjryVxZJJt8-4PaQIt1ayRgrI6nLpYKJm9rfPa_Vn70qdRLZ572eDCWlX5Hojv7G57Cxy6mR1veSR_IAC8IOr8vBGH2DT4ymr_A5TWVVIMJ1zjmPSgB1kqLjabk6jnNFxzUzPIqrbHlJE&sai=AMfl-YQkPIvmwLVI2NGkJaeUtBXA6FtlGHfM9jGdOsav6Umr_OOwfWdS5rQLV0I7GGhVbeVyR7TIRyWQiLkac5b8XLkoyBiExnCccgPNuw1dj1t7uIUlWmcrYX6faz4&sig=Cg0ArKJSzL6uF-xphCxZEAE&cid=CAQSOwDICaaNquZZdzR9uyZZ7qWCDyS1972aSA7QWWQlDrqA_wJZcmZxOR9qBzcIw9nwCsfd0dgx2fw0FcnRGAE&id=ampim&o=886,59&d=480,480&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=462&tls=1462&g=100&h=100&tt=1462&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://forex.alghtas.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 24AB 42 B
64 B 49ms
49ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstCScwjkEf8dRSWUIwKIX9_JfwXE1KFGJ5emLKHWESq3jl7TAnR2qteqBJb78oJt2MmomNRqx3zFQy_KxtrdO3YJ3gJQKJBqRDtKjE0W3T1VNLkaLS8wjzPmJ52xSLYZ8sCTIiqUshJvxfN&sai=AMfl-YTNiZHeAF99RTcQOZQ1sq6tBJ_5xQJ9RQJhvi6HSHQ4nvpfT0hjoSJj7-Driu904nWdA4RmiEEir8eHG46DLz-mpcICqr1qjUEhNCv79xF_mOeKDG4cjAe68KQ&sig=Cg0ArKJSzHs2De9J_KsHEAE&cid=CAQSOwDICaaNquZZdzR9uyZZ7qWCDyS1972aSA7QWWQlDrqA_wJZcmZxOR9qBzcIw9nwCsfd0dgx2fw0FcnRGAE&id=lidar2&mcvt=1000&p=80,1280,155,1580&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4130203354&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700268387029&rpt=432&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame BF46 0
21 B 41ms
41ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=237050122911&version=m202309260101&ct=119&x=1&cor=5757475013580904000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Nov 2023 00:46:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvXtba7G8Lo7dYukPl-SA0LPkmOtEvlXPdGFVlqGcFf9HfPnUscxgUCwaPJ8JAVVzzaL-25uANuf6wh7TGM5E98P77g5RsoOE0Bbf67OmAChwZTe9sV2yxDl447ps7qkPirMXAz-XVuaqA9&sai=AMfl-YRBBiRcbYyxN4O232FS96-Ogevnjrt2Znk0JRZf6mJnA-7unBMFTCtO92BLwgd2fET57r4DJ-Ko11mvYUuGjKgX6W2L11S7YN6DQ02YAZZZeEu_AXqxPk1w5SciLidxjGvdR3MAYgV-5y5DdLtqJKYih7LLmeIRZxqm&sig=Cg0ArKJSzHucHNPiJycWEAE&cid=CAQSTwDICaaNwklgWC2mvH0W-xzRE3vTSnsdLX6jcl-Fg6Ex875K_EK2iuqR1vbxp7--xiNqIl2VWUsWkIPWkPYXIwSagrj710DSY8JOebDKikwYAQ&id=lidartos&mcvt=2262&p=0,436,90,1164&mtos=2262,2262,2262,2262,2262&tos=2262,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2126799684&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=b&rst=1700268384563&rpt=122&isd=0&lsd=0&ec=1&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Domain: ade.googlesyndication.com
URL: https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIiIq8qKnMggMVTfK7CB3_aAFbEAEYACDy4_Fe;met=1;&timestamp=1700268386957;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=1;

Domain: tpsc-ew1.doubleverify.com
URL: https://tpsc-ew1.doubleverify.com/event.png?impid=4b487ce85ce6496491ef6b25924e054b&flavor=0&gdpr=&gdpr_consent=&dvp_gdpr_Error=3&dvp_gdv2_Error=3&pltm=1&ee_dp_btreg=567181304&ee_dp_btros_64=0&ee_dp_asmm=1&vdur=150&eoid=16&te_exec=4&msrjs=4946&sdf=67108896&vit=2&isvelg=1&rmi=16&tltms=115&tetms=12&msltms=26&vltms=150&sei=290&vetms=189&tuviims=178&tuviems=517&engms=1&engisel=1&ee_dp_ddtes=2&dvp_dtcov=4&sim=3&ee_dp_rbgms=1&yld_phnpms=1944&ttfurm=1945&tmet=1945

Domain: tpsc-ew1.doubleverify.com
URL: https://tpsc-ew1.doubleverify.com/event.png?impid=4b487ce85ce6496491ef6b25924e054b&flavor=0&gdpr=&gdpr_consent=&msrcanlm=904&msrcannum=3&ee_dp_tmads=1945&eoid=17&tmet=1945

Domain: tpsc-ew1.doubleverify.com
URL: https://tpsc-ew1.doubleverify.com/event.png?impid=4b487ce85ce6496491ef6b25924e054b&flavor=0&gdpr=&gdpr_consent=&ismms=44&isumms=43&isvelg=1&nvr=6&elmtp=1&isbxdms=1844&b0=241&b11=1783&adhgt=90&adwdth=728&norwdth=728&norhgt=90&engisel=1&vsos=3&dvp_vsosnmr=16&lftb=2024&sftb=2024&dvp_unl=1945&tuums=1945&msrdp=2&naral=640&vct=512&vphgt=1200&vpwdth=1600&chgt=90&cwdth=728&scrhgt=1200&scrwdth=1600&strp=0&advisonl=false&isiabvms=1181&isuiabvms=1181&ispmxpms=1181&engalms=42&dvp_dpr=1&vstsz=920&eoid=18&tmet=1946

Domain: tpsc-ew1.doubleverify.com
URL: https://tpsc-ew1.doubleverify.com/event.png?impid=4b487ce85ce6496491ef6b25924e054b&flavor=0&gdpr=&gdpr_consent=&ee_dp_cvcmeeid=1&eoid=19&tmet=1946

Domain: tpsc-ew1.doubleverify.com
URL: https://tpsc-ew1.doubleverify.com/event.png?impid=4b487ce85ce6496491ef6b25924e054b&flavor=0&gdpr=&gdpr_consent=&metp=2&meeid=1&eoid=20&tmet=1946

Domain: tpsc-ew1.doubleverify.com
URL: https://tpsc-ew1.doubleverify.com/event.png?impid=4b487ce85ce6496491ef6b25924e054b&flavor=0&gdpr=&gdpr_consent=&sdf=67108900&eoid=21&tmet=1947

Domain: tpsc-ew1.doubleverify.com
URL: https://tpsc-ew1.doubleverify.com/event.png?impid=4b487ce85ce6496491ef6b25924e054b&flavor=0&gdpr=&gdpr_consent=&dvp_noEng=true&eoid=22&tmet=1950

Domain: ade.googlesyndication.com
URL: https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-YXnqKnMggMVVuG7CB2DKAYcEAEYACC5kINi;met=1;&timestamp=1700268386992;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv2KXqMSWRtPtdhpRpvVkkRhaDCkWUU6vnkFTLAxFeQXFDIH_Ghy7_H2qdje1WQdT-YXm0WAVWRDKm-rpO8tNZ3yUDcc9umzi1aoeqJr1ipeyfdFftI9SFVnkaB7TtY-X6_jLY-_5IRI_XD&sai=AMfl-YQK6Il7nSMOCQzeTMJPzBs9VLd-rvZRGf1rNn9VWwKUXNYR8pSXb02olEafSu9eV-7Pzxbw5ihWYOStQusqT8dlGPDZ0aoUIc-SXCMkDQGA9q-HHEjLezaUMSg4j4h5pAvQ2itep3Ykorq4fK2i&sig=Cg0ArKJSzM5uOMyNXu7uEAE&cid=CAQSTgDICaaND4p2zCtTNXpEmfuyQdtYVKqW84vk_iK4KkU9PshWRrvcGTHNF6ryB0cDUsnVwqR_DHCCL582vCveKN7PiTMqJiBbG8eZE_QPVhgB&id=lidartos&mcvt=1355&p=80,1280,130,1600&mtos=1355,1355,1355,1355,1355&tos=1355,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=4130203354&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=b&rst=1700268385270&rpt=362&isd=0&lsd=0&ec=1&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Domain: ade.googlesyndication.com
URL: https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIorT4qKnMggMV7cC7CB0tnARXEAEYACC5iY1d;met=1;&timestamp=1700268386997;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssMCviF3p25G8_FV5G0UzbC8Lkvrfir1YKh2LcmLllA9savXBDr5pNAgvimmXZOGc4cCUd156xDvwerC-GalgJSYmVahQ_a7G8mWqT02mxBhbxL2q7Nsm-JLtU_N-ZAmGBXbV0Qi55jVX52&sai=AMfl-YS9MwG8eAIxG4Z-mUKnEgztFNzFRLuMqPQHuAszxHxgqiDbiObSOu5dsAQmYl5HKkFAjRE03hKmnWwVYYgUZWCVpF7kquqhnfsDJBAquVxzrWuDJ3EAcscDvEfv&sig=Cg0ArKJSzP1WJ2u_M_MWEAE&cid=CAQSPADICaaNWXWA3kE1HbGhppw5o5PoL8l0g-mpwZKSnWlxZ_kRzludqTqR-BypWji6mSBbr90fw70HCqHBThgB&id=lidartos&mcvt=849&p=59,1066,309,1366&mtos=849,849,849,849,849&tos=849,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=368548625&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=3&r=b&rst=1700268385571&rpt=544&isd=0&lsd=0&ec=1&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Domain: sync.search.spotxchange.com
URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESED8upFD0e76Fco_VS713bZs&google_cver=1

Domain: sync.search.spotxchange.com
URL: https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID

Verdicts & Comments Add Verdict or Comment

68 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
forex.alghtas.xyz/	1969-12-31 23:59:59	Name: PHPSESSID Value: ujbgi4jav4h0udhuv0bnenfdag
.casalemedia.com/	1970-01-21 01:03:24	Name: CMID Value: ZVgJYJJiT797tUzxZASq5gAA
.casalemedia.com/	1970-01-20 18:27:24	Name: CMPS Value: 5210
.casalemedia.com/	1970-01-20 18:27:24	Name: CMPRO Value: 5210
.adnxs.com/	1970-01-20 18:27:24	Name: uuid2 Value: 2619434366963023420
.alghtas.xyz/	1970-01-21 01:39:24	Name: __gads Value: ID=59381e6acceb571c:T=1700268383:RT=1700268383:S=ALNI_MZTcP2U25ur0RH7QPEEYgBFKiT-3w
.alghtas.xyz/	1970-01-21 01:39:24	Name: __gpi Value: UID=00000ccb7abc4673:T=1700268383:RT=1700268383:S=ALNI_MYWLudS9QetrBpRiRXYCjyUPJAXHw
.doubleclick.net/	1970-01-21 01:39:24	Name: IDE Value: AHWqTUnHntkHndOoOzld4AA8kyleXj1eO2ulqXuimCJOYWoIwh886wOczlAx1ELsLL0
.doubleclick.net/	1970-01-20 16:17:51	Name: DSID Value: NO_DATA
.adnxs.com/	1970-01-20 18:27:24	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E>0q'/qy!]tb68i_iqf!oN/@E'zz<Z2$NBB#PQg#RbcsXCZ^Y`xfcGq4?9xpP<T=0k:TD._PlZ[C[-kX-:auqV
.w55c.net/	1970-01-21 01:48:02	Name: wfivefivec Value: iXuiPiYd1R49tE5
.w55c.net/	1970-01-20 17:01:00	Name: matchgoogle Value: 5
.csync.loopme.me/	1970-01-20 18:30:17	Name: viewer_token Value: 4bc4f3dd-8841-43c3-9be6-eea352f97f39
.turn.com/	1970-01-20 20:37:00	Name: uid Value: 2338566836949069078
.simpli.fi/	1970-01-21 01:04:50	Name: suid Value: A9010D608AC14006BA83623780E34028
.de17a.com/	1970-01-21 00:56:12	Name: guid Value: 1.3552197124483983086
.yahoo.com/	1970-01-21 01:03:45	Name: A3 Value: d=AQABBGMJWGUCECa4vfTy4_Y9IeqZCgdYLj8FEgEBAQFaWWVhZQAAAAAA_eMAAA&S=AQAAAhW7PCpnLnR9irJNEO7AATk
.doubleclick.net/	1970-01-20 20:37:00	Name: APC Value: AfxxVi6exjrR8XaZ92cgzhafEthiebLPFy0wor2hcx3hXRB631LBjA
.tribalfusion.com/	1970-01-20 18:27:24	Name: ANON_ID Value: alntuJtZdPuem7SpBmTo7T2aOissBZbxotKqRZdQGYQvb0GmDZabUvUWP6V61stOZcK3X1ALK6ggAGpTVtBBGPxCwMjmo

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESED8upFD0e76Fco_VS713bZs&google_cver=1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1700268384848ad999fbf64e5ae9e2aa136f725820b903ac08b978b3.trk.sensic.net
599ea0b9588729b11d2a9bf5d4fd9030.safeframe.googlesyndication.com
a.tribalfusion.com
ad.doubleclick.net
ad.turn.com
ade.googlesyndication.com
cdn.ampproject.org
cdn.doubleverify.com
cm.g.doubleclick.net
csync.loopme.me
d5p.de17a.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
forex.alghtas.xyz
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
pagead2.googlesyndication.com
pixel.de-config.sensic.net
pm.w55c.net
portal.o2online.de
pr-bh.ybp.yahoo.com
r.turn.com
rtb-csync.smartadserver.com
rtb.openx.net
s.ad.smaato.net
s.tribalfusion.com
s0.2mdn.net
secure.adnxs.com
securepubads.g.doubleclick.net
sync.search.spotxchange.com
sync.teads.tv
tpc.googlesyndication.com
tps.doubleverify.com
tpsc-ew1.doubleverify.com
um.simpli.fi
ups.analytics.yahoo.com
us-u.openx.net
www.google.com
www.googletagservices.com
www.gstatic.com
ade.googlesyndication.com
pagead2.googlesyndication.com
sync.search.spotxchange.com
tpsc-ew1.doubleverify.com
104.18.36.155
130.211.44.5
141.101.90.96
142.250.184.226
142.250.186.70
162.0.209.219
185.86.139.94
2.16.97.41
213.155.156.185
2600:9000:211e:3a00:1b:5138:8a40:93a1
2600:9000:223d:c400:c:bbc8:bbc0:93a1
2600:9000:2644:8c00:1f:f009:8540:93a1
2606:4700::6812:18ad
2a00:1450:4001:806::2002
2a00:1450:4001:80b::2001
2a00:1450:4001:813::2006
2a00:1450:4001:81c::2003
2a00:1450:4001:827::2002
2a00:1450:4001:827::2003
2a00:1450:4001:82a::200a
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2004
2a00:1450:4001:830::2001
2a00:1450:4001:830::2002
2a00:1450:4001:831::2002
2a02:26f0:3500:d::1732:83c8
2a05:d018:d29:3601:af70:5903:a54a:226c
3.125.12.15
3.71.149.231
34.91.62.186
35.214.192.64
35.227.252.103
35.244.159.8
37.252.171.52
46.228.164.11
019a22e01a8d0e032c7b7a9ebb128430d037896a448a1548a05feab293ddea35
02b21d5ddc1521d729fd6157fe5222c1aeafd6d32b59f40fc02dfb8a3b64a418
04cf711116f1fa929429ed20aa11ec4a6be116dce322e5356cc27f14e3157583
0841b43610f53c5ab7259c11e0a8935c2c4e749fd0af052bfdd01fdb7f259897
0b26ac669eb1618766e1432f2c9c6603791c83b6e6e8073bf207011421d1e64f
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0b9ddc690ee7b603a9a0a11d43fbeabf73fe9c08ac83a02c0f79add2a27e13b0
0bbfaaa6e8f59636633b8b0dba1bb295c95c8f73ac3795e3eccca66ce570d4ba
0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e
0d7e4717b00089b5fe09f64ffc7c582128baf5577e146e6f7878ff76e6333374
14e257ca5b2db4666c6edba66b8154bb3128176262d5cf1ad9bb5f782e08b55c
14f4f917b58f69aef8732aaf4cb6055ad75722214fc867a7f576ec96abdac281
1583f28a50c73c0f65790ed46f422295ae9c61397fba7acd291e4d6487636909
1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5
179799dd3df94951d7295fdd0bbb1b98a423154cefdd2b1b285b6b56ce9da7a9
18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf
18ebc36644e10f87e20812c15e329c1b25848c62cd6cdfe74427cdf8995bc3a9
1b4e2c3b84fe75916b109ac323d0eb39e3881a892f7b7a21970a0cb9e694b3d7
1d09330d8772f0b916d1b9e56009d2e205358b0a593739839009e1fe0383eca8
1dd81ca0515d290c7ff168f90884270ca75263bc960f4b22f8b5980022eb38a5
2041039b19a5c1469de7ae22fa8a0c38b76c992347466c673d1b92f7f5540318
20aa5d9a3e5828c560a2ff2996e9b63b1df8db4b99a9b87a08ce5254a2d82a14
20b2612ca01552a9905e6f056188b807d41f8afa567dfa064c1c63569a025986
22c878a4e61529c23facfd4f611fa0c05f188b4da49e79004934ace9f802680d
25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6
25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af
2823c17a2611bb4e0cbba265d7c41bf1e472e0a76f6b3989fb0827d25b022943
29431992f8789a95b85a5ae40c7eb0b29065013a53fb69e52e24d439bee63932
29b0c3bf4a426a6a90d55c87ad783d8d06dce0aa7f36dfff406790272c8eae23
2a1e51b39610b1ce9fa2034995f814490d2b5e0ec9c81a7cdc5afd8e052563bd
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
307ee842c964fc1d103df2ed1906b58c9f73cc685e644b4e570dd4aac9baea27
31535a91ce3f6b8ed3ddedadab1e49957e2220263a640df1a3f14f6fdfe15eb6
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
32b1c3112d7f0bf7b2390f8947f9db048208e8c46fb2226e1d14e82da8781ee8
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
34b62ac29ff6ee85d0138a81f1353c669781e848df00753edd81f6dbfa9c9fd8
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b
38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642
3907cc5ed9d4a0cdb316d069614220b55fccd5624ac173592a7a4c2c3aae0636
3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658
3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e
3fbac6f606aa2da2e896ca92b5809ded0973fe1a6fb964fe56b59d69870edf3a
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
4347e083fcc7406a94363480146e1cf9c2f88198921ef74fed3eddf6d969725b
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
45b61408e1f1027e7f78dc1a5df291e0f5d1133d725d9d3b05c30c21e75555c2
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40
483600dac45a0560e87d8f10fc182b124b03b97a18a0eca2aa0ad0e83a60b9fa
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
495935f624a2d1ce73cadc4c9f75bf73b630ddfc6bff3b32143986c4d1ca9cb5
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4dd4d9c5d7987a600fa300712b658e2fe334d4d6fc5a3ae1cf07a9b94c9740d9
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
516f5e4c2dc5c69f3e1707e76695f866f8e62468aca15c1a9ddb165eb684f6f0
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
532cc63b02ed8f53da56d150a5e594a9a7bc44334a376556f9ffd2d5078197f0
54d2bf7a7c64822f0a37878124639151b927eb61771ab740932e682f26e4fd35
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5763d37aa015376976cd4cfd8ec0c1fc2536bdef0a9ca1da1670e2d1219f4fbf
596f5fe07ada5d8ae7423c1dcb901e556245326d2bf2196df38193cbf9cd11ad
5a319bae1aec7a32b75ee01c45b6e281a8cbbd2bcf520afee96ecb409eaf7585
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5c79b80ec32a532b360605538ac97c5b2b4fc85f57825582eff5318be177cca2
5d61c044067e0201fe4a58d48f092e2791dde05ac429a721260f4168da1143b5
5edfd4d63a63f0e73e5e233040b1916c3398c798742c06d7522afa27c29c1ceb
5ee042f559ab7fd95fc25a01797239fefc0bb4b70e1b6f7bd53a13cb68e5ac07
5ff02cd3b1882ce53cf8cb421e1bc13d73f094695591425d753530f52bb27fdd
610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6391c24064671e12dd5bb677aad7675bc2541b8ff92717fa1fc1c0cd5ffb845b
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
690773c9f78f3c693f8fa7e428408d04f5c0d5539f013ecf43c19c7fe1ae318f
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6abe94c8db415593d42b093301152b1e9c727364c2b5ed05b5ca2f163d8aa747
6b53f8bd5c74dde97821851bc0b2331e8ef34df22f280c53b9c042c75ea0f0d3
6cbe1eb742bec0d1f2ff2ac196d6acd6c7bb6c6c4478d4b8df03ebdf9db35a8d
6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f
6dcf5513db2216b938acffe6e78d51addb42160ad58c5d06206578a6fc251fa5
6f01eb26f54351d53cf482e3e292b7f739c7193a69165dce82bbcef77ce804a8
6f741883eafc84067b80014e53fbfab2505aca4f7cf767b17404a291fffb79d4
75737dd81c9731e837f2c3d6490b9961bfba625fd51813503bfd0fd95aa4266c
780ec0d1b2ad933e794cae2465317c58cfc86ac7191c2c450e62ed94683a0abc
78b549dcb0e1d79020914936a2382debab3e87b4686de6864c0706f82b310e8d
7d127f785466a5f2cb05370e0ed70047d4668422733c96e3c8cf903c4239efd8
7d4f28083f752036e12cd7c6e668a8035e9b05c08ba515cbb5f70376ea46c71d
7f1af0c6c916ebd2a9d558361567be79dc9ecb2f7d4ab0bb62defcc7498fedb1
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
7ffe4c22b2d19e8acf7c7b334bc80e24807cb3ec801a997218706a74b0cd61bd
84a1dbeab408381c75326559a1bd5712cc0ea089a2e753c825d19af2a660c2b3
8698d53751209aedd02dbe44175475604b8f7b0558acd20132e92d8b643e25e1
87664d848161d3a5bf83a511f4f483dc05e8472d06aedd5111488d267af298bb
88588830962cdb62afa928436cb3c7aa7a571cef13c2cae0b3f3b014f3d1c0fe
8898fb76403a4c8c20809b386e768297f0f5da7a287d31ae036ea225fbc835a0
892e60dbfc3ed039098df6041eae6e7ecc9401632e6692e709067f9dd8a8b7fa
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a9eaa2867d90c208cc4cde7402d0023b97dc30abcbfed1fe303194c4420a8ef
8ab43ef523c52e830a7706ae32581ae882ebe14920d3e88ee191ac6aea78c401
8ace5b9bf52f3c6d12f1ca2bab58f97d6dbe6eeced381ee9d1e05bf751f32568
8bc683ec7ab9dd68962a2c387fa15928e782171e433a18be6d7ff884288e01c5
8bd7e75c205b1650b2b9feb33de1565ec74c9213a030f287e5005e726daf9d6c
8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a
902d2fe5a28ca640f1ab4888afdf2ab02cc6d74424756fc7a7fea554dcd05693
9095c1b53b6dfe9409ee04f87bc321e739b659217251e3496bd4e7b5145d386d
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5
9b648cb10b96d05d057443cb9f2ead54a6b222a66fe166b604d2a1be37f70555
9c6fdee436c01218d40d57e11c8a123880671323c6b2b2d73ffdf04d45a2a55f
9f9a51e343f2a6114278c254dd21c5f01648cd2d468e13c98e5c97f516f4cf89
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a097fddcd59bf24167b004c67516760b41d64594c1da03f7e4e0554637a2c83f
a4df808f14cbbbb201a14fa137067cd77cf3ad61cdd8ecb64e4aa060eebb6439
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
aaa41c92c5a8c4640b5bb2173ac6694f87c298913f4defbc6fb837314022579b
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
ab84f06cdb5500ea115038beb904121ebc594ffbf4e1ab3ed4da78d33d3058f0
ad9af62a18d9f2009b3e03f67fd3c405281eb3114af1bef16f93ce2201210eb1
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b04dfae5d49297b8b6a514bd8bf1c7bea7ebe622232401a5abed5a92809a2b66
b13af0813c9f451df49143bd8c90c466cecfed02791371384e3ae9c0e085133b
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3e5a81e78a5b3df3781c4a0166340557ec736ccc9ca2c61fb9e0dca4cdc12ae
b53b6ad23b258ce11eed97786741510819a369348afcf1260856fe3041fc33de
b573a1c9614ddaea83c8617720f1c133bffc92093b37ebb4abb0df9b546805c7
ba7570386407f52b0870906be17a771dc0af509c9cfee072f08af860793f5756
bdb5f218320f40b8e08d2eef06eb81fe802515a4603605baba644446779a1262
c12f8511dfa5913b237ead640f66cd5eaa417896f814c100dce797d3afe675c2
c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95
c2ef506f97a32c27aee78050421695d57a16852e97fe21e93bf60b48895bb770
c4b813f7aa04eca20be469b259cca2779799f58e280d73488bd7386940d2d146
c6077711ce3174050ccebe6559eb5f0e251942c2cad21900d1c3ef316065565b
c7e2f7e6132fd1fcffd09eea9041f2bbd74feea33743c80b4fcaa27415b88eea
c7e76d44c88e8c172f66eb413a359494fdc7569ebac417ac2de0c2a232152dd8
c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cece5b9224fbb6ce36a3770b9f8cb1749b409616fc382b14c4111b9ea575907c
d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d136dde82d6fa957915b1345b932a3a52a6f86a1a4f5979c3e574a965f70c13a
d546c9fada91058c2d7037d2c7d786565783b40b49c7956bc812b1c63c5eaf18
d5d4844e8e59a54167ca6d54fcdd5819c4399e23e98c1135373415c67a0e7842
d6313ccc040c5c11bd9bbcebe132481116d8e5a0a324549bce70513bcfe760d2
db2282c7f9b938aceabbad4422ad9dd74390aacbb5730e0a2dd42abd37202ee3
dc00d2dc19a9dd32d5f89ec3d68bfed90dd775a5fa638855b7fe00d6415f379b
e2a3a2f67668b360af3706c7ae2da7df902f9375ab9ea284ae959f2fa43bbd55
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e329117bbdc12ee0649ed6654138a9ba8e600eaddf9138752631a50d236d135a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839
e4efcd6ec7d1fc476d9d3f43480ec9fb2b37ebcca255edefd2cfad8d2a96c27a
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
eab2091e72288a7fcf3235bd978b63d33900194440c455ea2769628da948c6b1
ead5b99e6b351a021b377a3db8292e3676aee695fe4bb023de0babbd4693b1f8
eaf2cca604f954ea93606a6f4b85f09ba852f2a849dfe1fdc9acdb43548dfe15
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ed09e939fdfe0e6aeb1a27a6de975577b8856af406d240d38e7c0fd08d408ee9
ed2d77ad6f19808e45fa19719a3818fa3f7c9f8f2e1accceefe0026d8376eab2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f015d154093e1cd0ac4cc4c9d9f8f304afcae6266d2c862d6275835f0b1ebee9
f0887deac8c4b1acaadc22093dc98fc95cbb3b52b21c727fb5cba4203d56e880
f21faedddd30758df150bb8fa894e91026cb3cfecc9b346052baf7d22c35fff9
f259c256b7e0066658547c031f67d5ded671915621353191943529b547b242cb
f28cd41b36762b675496df038342f672a1820d8042e6476a848151920efac8cf
f3236d5878ad1a21e043d4b7d323103b1695ef9ab1e175543e3f79c5a47aea7e
f53d596cc08d060c93833415f3af4a3e92822a807475d6f8501053c1ea105975
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f802f9dc3044e971e890fbdbfbdabf2dfeab99ec670d366f56f393826cdd1264
fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1
fcab446e7b0692310a0ba1932598df5d5bac964d7de3b05b0298c3e8038412b4
fdbd418f02c536d4b04e4411ea09246c67a859c7b31fbc9742c5305ab890ba31
fe9f7c1bc8e29059f762c0eef6ee762af1fa468a5644ee9345e6cd06380320b9
fff71a83690454ee6ea9014780a6797408918cb90cde1f0f3be65ea28a03c678

forex.alghtas.xyz Open in urlscan Pro 162.0.209.219 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

383 Requests

86 %HTTPS

51 %IPv6

26 Domains

42 Subdomains

30 IPs

8 Countries

4151 kBTransfer

11715 kBSize

19 Cookies

7 Outgoing links

Page URL History

Redirected requests

383 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

forex.alghtas.xyz Open in urlscan Pro
162.0.209.219 Public Scan

Screenshot
Live screenshot

Full Image

383
Requests

86 %
HTTPS

51 %
IPv6

26
Domains

42
Subdomains

30
IPs

8
Countries

4151 kB
Transfer

11715 kB
Size

19
Cookies

383 HTTP transactions
11 data transactions